#VU10655 Memory corruption in Quagga - CVE-2018-5378
Published: February 19, 2018
Vulnerability identifier: #VU10655
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-5378
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Quagga
Quagga
Software vendor:
quagga.net
quagga.net
Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the Quagga BGP daemon due to failure to properly bounds check data sent with a NOTIFY to a peer by the Quagga BGP daemon, bgpd. A remote attacker can send specially crafted input and cause the bgpd process or the daemon to crash.
The weakness exists in the Quagga BGP daemon due to failure to properly bounds check data sent with a NOTIFY to a peer by the Quagga BGP daemon, bgpd. A remote attacker can send specially crafted input and cause the bgpd process or the daemon to crash.
Remediation
Update to version 1.2.3.