quagga security update

0.99.22.4-5 - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code - Resolves: rhbz1546015...

openSUSE: Security Advisory for quagga (openSUSE-SU-2018:0473-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2018-5380

CVE-2018-5380 affects the Quagga BGP daemon (bgpd) prior to version 1.2.3, which can overrun internal BGP code-to-string conversion tables used for debug by one pointer value. The connected sources corroborate that this is one of several Quagga issues (CVE-2018-5378–5381) and show remediation pat...

CVE-2018-5378

CVE-2018-5378 affects the Quagga BGP daemon (bgpd) before version 1.2.3. The vulnerability arises from insufficient bounds checking of data in a NOTIFY when an attribute length is invalid, allowing arbitrary data from the bgpd process to be sent to a peer and/or causing bgpd to crash. Relevant re...

CVE-2018-5379

The CVE-2018-5379 issue affects the Quagga BGP daemon (bgpd) prior to version 1.2.3. The root cause is a double-free of memory when processing certain UPDATE messages that contain cluster-list and/or unknown attributes. This can lead to a denial of service (bgpd crash) and, in some cases, may all...

CVE-2018-5381

The vulnerability CVE-2018-5381 affects the Quagga BGP daemon (bgpd) prior to 1.2.3. It stems from a bug in parsing the BGP OPEN Capabilities in bgp_packet.c:bgp_capability_msg_parse. When a Multi-Protocol capability lacks a recognized AFI/SAFI, the parser can enter an infinite loop, causing a de...

CVE-2018-5381

Removed by vendor...

[SECURITY] [DLA 1286-1] quagga security update

Package : quagga Version : 0.99.22.4-1+wheezy3+deb7u3 CVE ID : CVE-2018-5379 CVE-2018-5380 CVE-2018-5381 Several vulnerabilities have been discovered in Quagga, a routing daemon. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2018-5378 It was discovered that...

Quagga bgpd is affected by multiple vulnerabilities

Overview The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service, information disclosure, or remote code execution. Description CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2018-5378...

CVE-2018-5381

The Quagga BGP daemon bgpd prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgppacket.c:bgpcapabilitymsgparse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI,...

EulerOS 2.0 SP2 : quagga (EulerOS-SA-2017-1308)

According to the version of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A denial of service flaw was found in the way the bgpd daemon in Quagga handled the processing of large BGP update messages. A remote, previously...

Updated quagga packages fix security vulnerability

The bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity CVE-2017-16227...

MGASA-2017-0416 Updated quagga packages fix security vulnerability

The bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity CVE-2017-16227...

Design/Logic Flaw

bgpd in FRRouting FRR before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes...

CVE-2017-15865

bgpd in FRRouting FRR before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes...

CVE-2017-15865

CVE-2017-15865 affects FRR (bgpd) in FRRouting before 2.0.2 and in 3.x before 3.0.2, used in Cumulus Linux before 3.4.3. A malformed BGP UPDATE from a connected peer can trigger transmission of up to thousands of unintended bytes, causing information disclosure. The issue stems from mishandled at...

CVE-2017-15865

bgpd in FRRouting FRR before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes...

CVE-2017-15865

bgpd in FRRouting FRR before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes...

CVE-2017-16227

A denial of service flaw was found in the way the bgpd daemon in Quagga handled the processing of large BGP update messages. A remote, previously trusted attacker could potentially use this flaw to cause bgpd to terminate existing BGP sessions, thereby leading to denial of service...

Debian DLA-1152-1 : quagga security update

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity. For Debian 7 'Wheezy', these problems have been fixed in...