CVE-2018-5378

2018-02-1913:00:00

CWE-119

certcc

www.cve.org

quagga

bgp

daemon

vulnerability

version 1.2.3

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.575

Percentile

97.7%

JSON

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

CNA Affected

[
  {
    "product": "bgpd",
    "vendor": "Quagga",
    "versions": [
      {
        "lessThan": "1.2.3",
        "status": "affected",
        "version": "bpgd",
        "versionType": "custom"
      }
    ]
  }
]