CVE-2007-1995
Fixed in a distro release EPSS 2%
bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.
Products: quagga
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.1 | quagga | 0.98.3-7.4 |
| Debian 4.0 | quagga | 0.99.5-5etch2 |
| Red Hat Enterprise Linux 3 | quagga | 0:0.96.2-12.3E |
| Red Hat Enterprise Linux 3 | quagga-debuginfo | 0:0.96.2-12.3E |
| Red Hat Enterprise Linux 4 | quagga | 0:0.98.3-2.4.0.1.el4 |
| Red Hat Enterprise Linux 4 | quagga-contrib | 0:0.98.3-2.4.0.1.el4 |
| Red Hat Enterprise Linux 4 | quagga-debuginfo | 0:0.98.3-2.4.0.1.el4 |
| Red Hat Enterprise Linux 4 | quagga-devel | 0:0.98.3-2.4.0.1.el4 |
| Red Hat Enterprise Linux 5 | quagga | 0:0.98.6-2.1.0.1.el5 |
| Red Hat Enterprise Linux 5 | quagga-contrib | 0:0.98.6-2.1.0.1.el5 |
| Red Hat Enterprise Linux 5 | quagga-debuginfo | 0:0.98.6-2.1.0.1.el5 |
| Red Hat Enterprise Linux 5 | quagga-devel | 0:0.98.6-2.1.0.1.el5 |
| openSUSE Tumbleweed | quagga | 1.2.4-2.14 |