CVE-2010-1674
NoneCVSS
—
EPSS
13.4%
Published
Mar 29, 2011
CISA due date
—
The record
The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:5.0 | quagga | 0 | 0.99.10-1lenny5 |
| Debian:6.0 | quagga | 0 | 0.99.17-2+squeeze2 |
| Red Hat:enterprise_linux:5::client | quagga | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client | quagga-contrib | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client | quagga-debuginfo | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client | quagga-devel | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | quagga | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | quagga-contrib | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | quagga-debuginfo | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | quagga-devel | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::server | quagga | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::server | quagga-contrib | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::server | quagga-debuginfo | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:5::server | quagga-devel | 0 | 0:0.98.6-7.el5_8.1 |
| Red Hat:enterprise_linux:6::server | quagga | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::server | quagga-contrib | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::server | quagga-debuginfo | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::server | quagga-devel | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::workstation | quagga | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::workstation | quagga-contrib | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::workstation | quagga-debuginfo | 0 | 0:0.99.15-5.el6_0.2 |
| Red Hat:enterprise_linux:6::workstation | quagga-devel | 0 | 0:0.99.15-5.el6_0.2 |
| openSUSE:Tumbleweed | quagga | 0 | 1.0.20160315-5.1 |
Related vulnerabilities
- CVE-2013-2236 Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API… Also affects quagga
- CVE-2016-1245 It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a… Also affects quagga
- CVE-2017-5495 All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory… Also affects quagga
- CVE-2016-2342 The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in… Also affects quagga
- CVE-2018-5380 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP… Also affects quagga
- CVE-2018-5378 The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the… Also affects quagga
- CVE-2018-5379 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when… Also affects quagga
- CVE-2018-5381 The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of… Also affects quagga