National Cyber-Alert System

Vulnerability Summary for CVE-2009-1572

Overview

The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (05/18/2009)

Not vulnerable. This issue did not affect the versions of zebra as shipped with Red Hat Enterprise Linux 2.1, and the versions of quagga as shipped with Red Hat Enterprise Linux 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: DEBIAN

Name: DSA-1788

Type: Patch Information

Hyperlink:http://www.debian.org/security/2009/dsa-1788

External Source: MLIST

Name: [quagga-dev] 20090203 [quagga-dev 6391] [PATCH] BGP 4-byte ASN bug fixes

Type: Patch Information

Hyperlink:http://marc.info/?l=quagga-dev&m=123364779626078&w=2

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311

Type: Patch Information

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311

External Source: FEDORA

Name: FEDORA-2009-5324

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01107.html

External Source: FEDORA

Name: FEDORA-2009-5284

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01037.html

External Source: XF

Name: quagga-systemnumber-dos(50317)

Hyperlink:http://xforce.iss.net/xforce/xfdb/50317

External Source: UBUNTU

Name: USN-775-1

Hyperlink:http://www.ubuntu.com/usn/usn-775-1

External Source: SECTRACK

Name: 1022164

Hyperlink:http://www.securitytracker.com/id?1022164

External Source: BID

Name: 34817

Hyperlink:http://www.securityfocus.com/bid/34817

External Source: OSVDB

Name: 54200

Hyperlink:http://www.osvdb.org/54200

External Source: MLIST

Name: [oss-security] 20090501 Re: CVE request (sort of): Quagga BGP crasher

Hyperlink:http://www.openwall.com/lists/oss-security/2009/05/01/2

External Source: MLIST

Name: [oss-security] 20090501 CVE request (sort of): Quagga BGP crasher

Hyperlink:http://www.openwall.com/lists/oss-security/2009/05/01/1

External Source: MANDRIVA

Name: MDVSA-2009:109

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:109

External Source: MISC

Name: http://thread.gmane.org/gmane.network.quagga.devel/6513

Hyperlink:http://thread.gmane.org/gmane.network.quagga.devel/6513

External Source: SECUNIA

Name: 35685

Hyperlink:http://secunia.com/advisories/35685

External Source: SECUNIA

Name: 35203

Hyperlink:http://secunia.com/advisories/35203

External Source: SECUNIA

Name: 35061

Hyperlink:http://secunia.com/advisories/35061

External Source: SECUNIA

Name: 34999

Type: Advisory

Hyperlink:http://secunia.com/advisories/34999

External Source: SUSE

Name: SUSE-SR:2009:012

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html