Executive Summary

Summary
Title Quagga bgpd is affected by multiple vulnerabilities
Informations
Name VU#940439 First vendor Publication 2018-02-15
Vendor VU-CERT Last vendor Modification 2018-02-19
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#940439

Quagga bgpd is affected by multiple vulnerabilities

Original Release date: 15 Feb 2018 | Last revised: 19 Feb 2018

Overview

The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service, information disclosure, or remote code execution.

Description

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2018-5378 (Quagga-2018-0543)

The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash.

CWE-415: Double Free - CVE-2018-5379 (Quagga-2018-1114)

The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.

CWE-125: Out-of-bounds Read - CVE-2018-5380 (Quagga-2018-1550)

The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

CWE-228: Improper Handling of Syntactically Invalid Structure - CVE-2018-5381 (Quagga-2018-1975)

The Quagga BGP daemon, bgpd, had a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI.

For more information, please see Quagga's version 1.2.3 release announcement.

The CVSS score below is based on CVE-2018-5379.

Impact

An unauthenticated, remote attacker may be able to use crafted input to result in a crash of bgpd or even allow a remote attacker to gain control of an affected bgpd process.

Solution

Apply an update

Quagga has released bgpd version 1.2.3 to address these issues. Affected users should apply an update as soon as possible.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Debian GNU/LinuxAffected06 Feb 201815 Feb 2018
SUSE LinuxAffected06 Feb 201819 Feb 2018
UbuntuAffected06 Feb 201819 Feb 2018
CoreOSNot Affected06 Feb 201807 Feb 2018
Alpine LinuxUnknown15 Feb 201815 Feb 2018
Arch LinuxUnknown06 Feb 201806 Feb 2018
Arista Networks, Inc.Unknown06 Feb 201806 Feb 2018
ASP LinuxUnknown06 Feb 201806 Feb 2018
CentOSUnknown15 Feb 201815 Feb 2018
ENEAUnknown15 Feb 201815 Feb 2018
Fedora ProjectUnknown06 Feb 201806 Feb 2018
GeexboxUnknown06 Feb 201806 Feb 2018
Gentoo LinuxUnknown06 Feb 201806 Feb 2018
HomeSeerUnknown15 Feb 201815 Feb 2018
Micro FocusUnknown08 Feb 201808 Feb 2018
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

GroupScoreVector
Base9.3AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal7.3E:POC/RL:OF/RC:C
Environmental7.3CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

  • http://savannah.nongnu.org/forum/forum.php?forum_id=9095
  • http://cwe.mitre.org/data/definitions/119.html
  • http://cwe.mitre.org/data/definitions/125.html
  • http://cwe.mitre.org/data/definitions/228.html
  • http://cwe.mitre.org/data/definitions/415.html

Credit

The Quagga developers thankAlban Browaeys, Balaji Gurudoss, Borg, Scott Leggett and Debian QA Group, Eugene Bogomazov, Evgeny Uskov, Gerrie Roos, Mathieu Jadin, Pier Carlo Chiodi, and Rolf Eike Beer.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:CVE-2018-5378CVE-2018-5379CVE-2018-5380CVE-2018-5381
  • Date Public:15 Feb 2018
  • Date First Published:15 Feb 2018
  • Date Last Updated:19 Feb 2018
  • Document Revision:43

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/940439

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-415 Double Free
33 % CWE-125 Out-of-bounds Read
33 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 44
Os 3
Os 3
Os 1
Os 2
Os 3
Os 2
Os 1

Nessus® Vulnerability Scanner

Date Description
2018-04-23 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201804-17.nasl - Type : ACT_GATHER_INFO
2018-03-20 Name : The remote EulerOS host is missing a security update.
File : EulerOS_SA-2018-1064.nasl - Type : ACT_GATHER_INFO
2018-03-20 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2018-1065.nasl - Type : ACT_GATHER_INFO
2018-03-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2018-0377.nasl - Type : ACT_GATHER_INFO
2018-03-07 Name : The remote Fedora host is missing a security update.
File : fedora_2018-9cd3ff3784.nasl - Type : ACT_GATHER_INFO
2018-03-07 Name : The remote Fedora host is missing a security update.
File : fedora_2018-b3e985489b.nasl - Type : ACT_GATHER_INFO
2018-02-22 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2018-957.nasl - Type : ACT_GATHER_INFO
2018-02-20 Name : The remote Debian host is missing a security update.
File : debian_DLA-1286.nasl - Type : ACT_GATHER_INFO
2018-02-16 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4115.nasl - Type : ACT_GATHER_INFO
2018-02-16 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_e15a22cef16f446b9ca76859350c2e75.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
Date Informations
2018-03-15 00:20:56
  • Multiple Updates
2018-03-12 21:21:45
  • Multiple Updates
2018-02-19 21:19:34
  • Multiple Updates
2018-02-19 17:22:05
  • Multiple Updates
2018-02-16 00:19:26
  • First insertion