PT-2023-8900 · Frrouting+9 · Frrouting+9

Melissa-Cjtop · Published 2023-03-24 · Updated 2024-11-28 · CVE-2023-31490

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Frrouting bgpd version 8.4.2

Description The issue is related to the bgp attr psid sub() function in FRRouting, which can be exploited by a remote attacker to cause a denial of service. This is due to the lack of neutralization of special elements. The exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations For version 8.4.2, consider disabling the bgp attr psid sub() function as a temporary workaround until a patch is available. Restrict access to the bgpd service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALSA-2024:2156

ALSA-2024:2981

ALT-PU-2023-1740

AZL-26729

BDU:2024-02578

CESA-2024_2981

CVE-2023-31490

DLA-3573-1

DSA-5495-1

INFSA-2024_2156

INFSA-2024_2981

OPENSUSE-SU-2024:12967-1

OPENSUSE-SU-2024_4090-1

RHSA-2024:2156

RHSA-2024:2981

RHSA-2024_2156

RHSA-2024_2981

SUSE-SU-2023:2518-1

SUSE-SU-2024:4090-1

USN-6136-1

USN-6323-1

USN-6807-1

Affected Products

Alt Linux

Almalinux

Centos

Frrouting

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 98

• 🔥 https://github.com/FRRouting/frr/issues/13099 · Exploit
• https://errata.almalinux.org/8/ALSA-2024-2981.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46752 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31490 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:2156 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-37032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31948 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-31490 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6323-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6136-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4090-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-38802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-38407 · Vendor Advisory