CVE-2017-5495
HighSummary
All versions of Quagga from 0.93 to 1.1.0 are vulnerable to unbounded memory allocation in the telnet 'vty' CLI, leading to Denial-of-Service for Quagga daemons or even the entire host. An attacker can exploit this vulnerability by sending very long strings without a newline.
Risk Assessment
This vulnerability can lead to crashes of Quagga daemons and the entire system, potentially resulting in service outages. There is a risk that an attacker could exploit this flaw prior to authentication.
Recommendation
It is recommended to upgrade to Quagga version 1.1.1 or later to mitigate this vulnerability. Additionally, access to the telnet interface should be restricted to local users only.
Other vulnerabilities in Quagga
See all- CVE-2017-16227High
The aspath_put function in Quagga before version 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages. A flaw in AS_PATH size calculation for long paths counts certain bytes twice, leading to the construction of an invalid message.
- CVE-2016-4049High
The bgp_dump_routes_func function in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
Original NVD description (English source)
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.