CVE-2017-16227
Fixed in a distro release EPSS 46%
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.
Products: quagga, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.3 | quagga | 0.99.24.1-r6 |
| Alpine 3.4 | quagga | 1.0.20161017-r1 |
| Alpine 3.5 | quagga | 1.1.1-r1 |
| Alpine 3.6 | quagga | 1.2.2-r0 |
| Debian 7 | quagga | 0.99.22.4-1+wheezy3+deb7u2 |
| Debian 8 | quagga | 0.99.23.1-1+deb8u4 |
| Debian 9 | quagga | 1.1.1-3+deb9u1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Server 11 SP4 | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | quagga | 0.99.22.1-16.4.1 |
| SUSE Linux Enterprise Server 12 SP2 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Server 12 SP3 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Server 12-LTSS | quagga | 0.99.22.1-16.4.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | quagga | 0.99.22.1-16.4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | quagga | 0.99.15-0.30.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | quagga | 1.1.1-17.7.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | quagga | 1.1.1-17.7.1 |
| SUSE OpenStack Cloud 6 | quagga | 0.99.22.1-16.4.1 |
| Ubuntu 14.04 LTS | quagga | 0.99.22.4-3ubuntu1.4 |
| Ubuntu 16.04 LTS | quagga | 0.99.24.1-2ubuntu1.3 |
| openSUSE Tumbleweed | quagga | 1.2.4-2.14 |