Quagga vulnerabilities
3 known CVE vulnerabilities in Quagga, translated and rated.
- CVE-2017-16227High
The aspath_put function in Quagga before version 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages. A flaw in AS_PATH size calculation for long paths counts certain bytes twice, leading to the construction of an invalid message.
- CVE-2017-5495High
All versions of Quagga from 0.93 to 1.1.0 are vulnerable to unbounded memory allocation in the telnet 'vty' CLI, leading to Denial-of-Service for Quagga daemons or even the entire host. An attacker can exploit this vulnerability by sending very long strings without a newline.
- CVE-2016-4049High
The bgp_dump_routes_func function in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.