Stack-based buffer overflow in BIRD Internet Routing Daemon - CVE-2019-16159

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU21407

Stack-based buffer overflow in BIRD Internet Routing Daemon - CVE-2019-16159

Published: September 29, 2019


Vulnerability identifier: #VU21407
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16159
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system or perform denial of service attack.

The vulnerability exists due to a boundary error when checking validity of BGP administrative shutdown communication messages. A remote unauthenticated attacker can send a specially crafted administrative shutdown communication message, trigger a four-byte stack-based buffer overflow and perform denial of service attack or execute arbitrary code on the target system.


Affected software

BIRD Internet Routing Daemon
bird (Debian package)
bird
bird2
Fedora
SUSE Linux
Opensuse

How to mitigate CVE-2019-16159

Install updates from vendor's website.

BIRD Internet Routing Daemon - addressed in versions 1.6.8, 2.0.6
bird (Debian package) - update to 1.6.6-1+deb10u1
bird - addressed in versions 1.6.8-1.el6, 1.6.8-1.el7, 1.6.8-1.fc29, 2.0.6-1.el8, 2.0.6-1.fc30, 2.0.6-1.fc31
bird2 - update to 2.0.6-1.el7

External References

Related Security Bulletins