Input validation error in frr - CVE-2023-46753

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82902

Input validation error in frr - CVE-2023-46753

Published: November 7, 2023


Vulnerability identifier: #VU82902
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-46753
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing BGP UPDATE message without mandatory attributes. A remote attacker can send specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

frr
Enterprise SONiC
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Anolis OS
Server Applications Module
openSUSE Leap
Ubuntu
frr (Ubuntu package)
quagga-bgpd (Ubuntu package)
quagga (Ubuntu package)
libfrr0
libfrrsnmp0
libmlag_pb0
libfrrgrpc_pb0
libfrrzmq0-debuginfo
libfrrsnmp0-debuginfo
frr-devel
libfrr_pb0
libfrrzmq0
frr
libfrrospfapiclient0-debuginfo
libfrrfpm_pb0
libfrrcares0-debuginfo
libfrrcares0
libmlag_pb0-debuginfo
libfrrgrpc_pb0-debuginfo
libfrrospfapiclient0
libfrrfpm_pb0-debuginfo
frr-debuginfo
libfrr_pb0-debuginfo
frr-debugsource
libfrr0-debuginfo
frr-selinux
frr-doc
frr (Red Hat package)
Red Hat OpenShift Container Platform

How to mitigate CVE-2023-46753

Install updates from vendor's website.

frr (Ubuntu package) - addressed in versions Ubuntu Pro, 8.1-1ubuntu1.7, 8.4.2-1ubuntu1.5, 8.4.4-1.1ubuntu1.1
quagga-bgpd (Ubuntu package) - update to 1.2.4-4ubuntu0.4
quagga (Ubuntu package) - update to 1.2.4-4ubuntu0.4
Enterprise SONiC - update to 4.4.1
Red Hat OpenShift Container Platform - update to 4.17.0
libfrr0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrsnmp0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libmlag_pb0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrgrpc_pb0 - update to 7.4-150300.4.20.1
libfrrzmq0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrsnmp0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
frr-devel - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrr_pb0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrzmq0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
frr - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrospfapiclient0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrfpm_pb0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrcares0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrcares0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libmlag_pb0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrgrpc_pb0-debuginfo - update to 7.4-150300.4.20.1
libfrrospfapiclient0 - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrrfpm_pb0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
frr-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrr_pb0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
frr-debugsource - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
libfrr0-debuginfo - addressed in versions 7.4-150300.4.20.1, 8.4-150500.4.11.1, 8.5.6-150500.4.30.1
frr-selinux - update to 7.5.1-16.0.4
frr-doc - update to 7.5.1-16.0.4
frr - update to 7.5.1-16.0.4
frr (Red Hat package) - addressed in versions 7.5.1-22.el8, 8.5.3-4.el9

External References

Related Security Bulletins