search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Quagga bgpd is affected by multiple vulnerabilities

Vulnerability Note VU#940439

Original Release Date: 2018-02-15 | Last Revised: 2018-02-19

Overview

The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service, information disclosure, or remote code execution.

Description

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2018-5378 (Quagga-2018-0543)

The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash.

CWE-415: Double Free - CVE-2018-5379 (Quagga-2018-1114)

The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.

CWE-125: Out-of-bounds Read - CVE-2018-5380 (Quagga-2018-1550)

The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

CWE-228: Improper Handling of Syntactically Invalid Structure - CVE-2018-5381 (Quagga-2018-1975)

The Quagga BGP daemon, bgpd, had a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI.

For more information, please see Quagga's version 1.2.3 release announcement.

The CVSS score below is based on CVE-2018-5379.

Impact

An unauthenticated, remote attacker may be able to use crafted input to result in a crash of bgpd or even allow a remote attacker to gain control of an affected bgpd process.

Solution

Apply an update

Quagga has released bgpd version 1.2.3 to address these issues. Affected users should apply an update as soon as possible.

Vendor Information

940439
 
Affected   Unknown   Unaffected

Debian GNU/Linux

Notified:  February 06, 2018 Updated:  February 15, 2018

Statement Date:   February 15, 2018

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

SUSE Linux

Notified:  February 06, 2018 Updated:  February 19, 2018

Statement Date:   February 16, 2018

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

Ubuntu

Notified:  February 06, 2018 Updated:  February 19, 2018

Statement Date:   February 16, 2018

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

CoreOS

Notified:  February 06, 2018 Updated:  February 07, 2018

Statement Date:   February 07, 2018

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

ASP Linux

Notified:  February 06, 2018 Updated:  February 06, 2018

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor References

    Alpine Linux

    Notified:  February 15, 2018 Updated:  February 15, 2018

    Status

      Unknown

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor References

      Arch Linux

      Notified:  February 06, 2018 Updated:  February 06, 2018

      Status

        Unknown

      Vendor Statement

      No statement is currently available from the vendor regarding this vulnerability.

      Vendor References

        Arista Networks, Inc.

        Notified:  February 06, 2018 Updated:  February 06, 2018

        Status

          Unknown

        Vendor Statement

        No statement is currently available from the vendor regarding this vulnerability.

        Vendor References

          CentOS

          Notified:  February 15, 2018 Updated:  February 15, 2018

          Status

            Unknown

          Vendor Statement

          No statement is currently available from the vendor regarding this vulnerability.

          Vendor References

            ENEA

            Notified:  February 15, 2018 Updated:  February 15, 2018

            Status

              Unknown

            Vendor Statement

            No statement is currently available from the vendor regarding this vulnerability.

            Vendor References

              Fedora Project

              Notified:  February 06, 2018 Updated:  February 06, 2018

              Status

                Unknown

              Vendor Statement

              No statement is currently available from the vendor regarding this vulnerability.

              Vendor References

                Geexbox

                Notified:  February 06, 2018 Updated:  February 06, 2018

                Status

                  Unknown

                Vendor Statement

                No statement is currently available from the vendor regarding this vulnerability.

                Vendor References

                  Gentoo Linux

                  Notified:  February 06, 2018 Updated:  February 06, 2018

                  Status

                    Unknown

                  Vendor Statement

                  No statement is currently available from the vendor regarding this vulnerability.

                  Vendor References

                    HomeSeer

                    Notified:  February 15, 2018 Updated:  February 15, 2018

                    Status

                      Unknown

                    Vendor Statement

                    No statement is currently available from the vendor regarding this vulnerability.

                    Vendor References

                      Micro Focus

                      Notified:  February 08, 2018 Updated:  February 08, 2018

                      Status

                        Unknown

                      Vendor Statement

                      No statement is currently available from the vendor regarding this vulnerability.

                      Vendor References

                        MontaVista Software, Inc.

                        Notified:  February 15, 2018 Updated:  February 15, 2018

                        Status

                          Unknown

                        Vendor Statement

                        No statement is currently available from the vendor regarding this vulnerability.

                        Vendor References

                          Novell, Inc.

                          Notified:  February 06, 2018 Updated:  February 06, 2018

                          Status

                            Unknown

                          Vendor Statement

                          No statement is currently available from the vendor regarding this vulnerability.

                          Vendor References

                            Openwall GNU/*/Linux

                            Notified:  February 06, 2018 Updated:  February 06, 2018

                            Status

                              Unknown

                            Vendor Statement

                            No statement is currently available from the vendor regarding this vulnerability.

                            Vendor References

                              Quagga

                              Notified:  February 09, 2018 Updated:  February 09, 2018

                              Status

                                Unknown

                              Vendor Statement

                              No statement is currently available from the vendor regarding this vulnerability.

                              Vendor References

                                Red Hat, Inc.

                                Notified:  February 06, 2018 Updated:  February 06, 2018

                                Status

                                  Unknown

                                Vendor Statement

                                No statement is currently available from the vendor regarding this vulnerability.

                                Vendor References

                                  Slackware Linux Inc.

                                  Notified:  February 06, 2018 Updated:  February 06, 2018

                                  Status

                                    Unknown

                                  Vendor Statement

                                  No statement is currently available from the vendor regarding this vulnerability.

                                  Vendor References

                                    Tizen

                                    Notified:  February 15, 2018 Updated:  February 15, 2018

                                    Status

                                      Unknown

                                    Vendor Statement

                                    No statement is currently available from the vendor regarding this vulnerability.

                                    Vendor References

                                      Turbolinux

                                      Notified:  February 06, 2018 Updated:  February 06, 2018

                                      Status

                                        Unknown

                                      Vendor Statement

                                      No statement is currently available from the vendor regarding this vulnerability.

                                      Vendor References

                                        View all 23 vendors View less vendors


                                        CVSS Metrics

                                        Group Score Vector
                                        Base 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
                                        Temporal 7.3 E:POC/RL:OF/RC:C
                                        Environmental 7.3 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

                                        References

                                        Acknowledgements

                                        The Quagga developers thank Alban Browaeys, Balaji Gurudoss, Borg, Scott Leggett and Debian QA Group, Eugene Bogomazov, Evgeny Uskov, Gerrie Roos, Mathieu Jadin, Pier Carlo Chiodi, and Rolf Eike Beer.

                                        This document was written by Garret Wassermann.

                                        Other Information

                                        CVE IDs: CVE-2018-5378, CVE-2018-5379, CVE-2018-5380, CVE-2018-5381
                                        Date Public: 2018-02-15
                                        Date First Published: 2018-02-15
                                        Date Last Updated: 2018-02-19 18:40 UTC
                                        Document Revision: 43

                                        Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.