Stack-based Buffer Overflow in quagga
Summary
DSA-3532-1: quagga - security update. Affects quagga versions < 0.99.22.4-1+wheezy2. Fixed in 0.99.22.4-1+wheezy2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quagga is a BGP/OSPF/RIP routing daemon that provides routing services for network devices. It allows routers to exchange routing information and make informed decisions about the best paths for data packets. Quagga is widely used in various networking environments.
The vulnerability in quagga affects the VPNv4 NLRI parser in the bgpd component. This parser is responsible for handling VPNv4 BGP (Border Gateway Protocol) peers. A stack-based buffer overflow vulnerability has been discovered in this parser, which can be exploited by a remote attacker to cause a denial of service (daemon crash) or potentially execute arbitrary code.
Vulnerability Detail
The stack-based buffer overflow vulnerability in the VPNv4 NLRI parser of bgpd in quagga allows a remote attacker to trigger a buffer overflow by sending specially crafted BGP packets. This can lead to a denial of service condition, causing the daemon to crash. In certain configurations where BGP peers are enabled for VPNv4, it may also be possible for an attacker to execute arbitrary code.
The vulnerability has been assigned the identifier CVE-2016-2342.
How To Fix
Minimum fixed version
0.99.22.4-1+wheezy2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade quaggaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the package upgrades as mentioned in the 'how_to_fix' section.
Conclusion
The stack-based buffer overflow vulnerability in quagga's VPNv4 NLRI parser poses a risk of denial of service and potential code execution. It is crucial to upgrade the quagga package to the fixed versions mentioned in the 'how_to_fix' section to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for quagga →
FAQ
Quagga is a BGP/OSPF/RIP routing daemon used for routing services in network devices.
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code on a system running quagga with BGP peers enabled for VPNv4.
To fix this vulnerability, upgrade the quagga package to the fixed versions mentioned in the 'how_to_fix' section.
There is no known workaround for this vulnerability. Applying the package upgrades is the recommended solution.
The vulnerability has been assigned the identifier CVE-2016-2342.
Related vulnerabilities
Recent vulnerabilities recorded for quagga.
