CVE-2016-2342
High · 8.1CVSS
8.1
EPSS
13.3%
Published
Mar 17, 2016
CISA due date
—
The record
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:7 | quagga | 0 | 0.99.22.4-1+wheezy2 |
| Debian:8 | quagga | 0 | 0.99.23.1-1+deb8u1 |
| Mageia:5 | quagga | 0 | 0.99.22.4-4.1.mga5 |
| Red Hat:enterprise_linux:6::server | quagga | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::server | quagga-contrib | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::server | quagga-debuginfo | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::server | quagga-devel | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::workstation | quagga | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::workstation | quagga-contrib | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::workstation | quagga-debuginfo | 0 | 0:0.99.15-14.el6 |
| Red Hat:enterprise_linux:6::workstation | quagga-devel | 0 | 0:0.99.15-14.el6 |
| SUSE:Linux Enterprise Server 11 SP4 | quagga | 0 | 0.99.15-0.16.1 |
| SUSE:Linux Enterprise Server 12 | quagga | 0 | 0.99.22.1-5.1 |
| SUSE:Linux Enterprise Server 12 SP1 | quagga | 0 | 0.99.22.1-5.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | quagga | 0 | 0.99.15-0.16.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 | quagga | 0 | 0.99.22.1-5.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | quagga | 0 | 0.99.22.1-5.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | quagga | 0 | 0.99.15-0.16.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | quagga | 0 | 0.99.22.1-5.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | quagga | 0 | 0.99.22.1-5.1 |
| Ubuntu:14.04:LTS | quagga | 0 | 0.99.22.4-3ubuntu1.1 |
| openSUSE:Tumbleweed | quagga | 0 | 1.0.20160315-5.1 |
Related vulnerabilities
- CVE-2018-5380 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP… Also affects quagga
- CVE-2018-5379 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when… Also affects quagga
- CVE-2018-5381 The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of… Also affects quagga
- CVE-2017-16227 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote… Also affects quagga
- CVE-2016-1245 It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a… Also affects quagga
- CVE-2016-4036 The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11… Also affects quagga
- CVE-2013-2236 Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API… Also affects quagga
- CVE-2017-5495 All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory… Also affects quagga