Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 36

Export CSV
CVE-2007-4826

quagga bgpd DoS

bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2009-1572

quagga: crash in bgpd when receiving updates containing asn32

The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Quagga
Products
Quagga
CVE-2007-1995

Quagga bgpd DoS

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

CVSS 2.0 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2003-0859

security flaw

The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Intel Quagga and 2 more
Products
Glibc Zebra Ia64 and 5 more
CVE-2006-2223

security flaw

RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.

CVSS 2.0 · 5.0 Medium EPSS 11.5% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2006-2276

security flaw

bgpd in Quagga 0.98 and 0.99 before 20060504 allows local users to cause a denial of service (CPU consumption) via a certain sh ip bgp command entered in the telnet interface.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2003-0795

security flaw

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

CVSS 2.0 · 5.0 Medium EPSS 8.4% KEV · Not listed
Vendors
Gnu Quagga Redhat and 1 more
Products
Zebra Quagga Enterprise Linux and 2 more
CVE-2017-16227

quagga: Incorrect AS_PATH size calculation for long paths

The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.

CVSS 3.0 · 7.5 High EPSS 46.0% KEV · Not listed
Vendors
Debian Quagga
Products
Debian Linux Quagga
CVE-2017-5495

quagga: Telnet interface input buffer allocates unbounded amounts of memory

All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.

CVSS 3.0 · 7.5 High EPSS 18.8% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2016-1245

quagga: Buffer Overflow in IPv6 RA handling

It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Quagga Redhat
Products
Debian Linux Quagga Enterprise Linux
CVE-2016-4049

quagga: denial of service vulnerability in BGP routing daemon

The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.

CVSS 3.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Opensuse Quagga Redhat
Products
Leap Opensuse Quagga and 1 more
CVE-2016-2342

quagga: VPNv4 NLRI parser memcpys to stack on unchecked length

The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.

CVSS 3.0 · 8.1 High EPSS 13.3% KEV · Not listed
Vendors
Debian Quagga Redhat
Products
Debian Linux Quagga Enterprise Linux
CVE-2013-6051

quagga: bgp crash when receiving bgp updates

The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Quagga
Products
Quagga
CVE-2012-0249

(ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet

Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.

CVSS 2.0 · 3.3 Low EPSS 1.8% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2010-1674

quagga: DoS (crash) by processing malformed extended community attribute in a route

The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.

CVSS 2.0 · 5.0 Medium EPSS 13.4% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2010-1675

quagga: BGP session reset by processing BGP Update message with malformed AS-path attributes

bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2010-2948

(bgpd): Stack buffer overflow by processing certain Route-Refresh messages

Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF) record in a BGP ROUTE-REFRESH (RR) message.

CVSS 2.0 · 6.5 Medium EPSS 4.0% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2010-2949

(bgpd): DoS (crash) while processing certain BGP update AS path messages

bgpd in Quagga before 0.99.17 does not properly parse AS paths, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux