PT-2024-12891 · Extreme Networks · Extremexos

Published 2024-11-10 · Updated 2024-11-13 · CVE-2023-40457

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Extreme Networks ExtremeXOS (aka EXOS) version 30.7.1.1

Description The issue is related to the BGP daemon in Extreme Networks ExtremeXOS, which allows an attacker to cause a denial of service (BGP session reset) due to BGP attribute error mishandling for attributes 21 and 25. The vendor disputes this issue, stating it is evaluating support for RFC 7606 as a future feature and believes customers have chosen not to require or implement RFC 7606 willingly.

Recommendations For Extreme Networks ExtremeXOS (aka EXOS) version 30.7.1.1, apply the latest patches and follow remediation guidelines to secure your systems. As a temporary workaround, consider restricting access to BGP attributes 21 and 25 to minimize the risk of exploitation.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-40457

Affected Products

Extremexos

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-40457 · Security Note
• https://blog.benjojo.co.uk/asset/JgH8G5duO1 · Note
• https://twitter.com/CVEnew/status/1855780215563124746 · Twitter Post
• https://t.me/cvenotify/101254 · Telegram Post
• https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling · Note
• https://t.me/cvedetector/10445 · Telegram Post
• https://twitter.com/transilienceai/status/1856752630951022819 · Twitter Post
• https://twitter.com/transilienceai/status/1856752618590408760 · Twitter Post
• https://supportdocs.extremenetworks.com/support/documentation/extremexos-32-5 · Note
• https://twitter.com/VulmonFeeds/status/1855787083652022352 · Twitter Post