Description
bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | quagga | 0.99.5-5etch2 | DSA-1293-1 |
| Debian 3.1 | quagga | 0.98.3-7.4 | DSA-1293-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | quagga +2 | 0.98.6-2.1.0.1.el5 | RHSA-2007:0389 |
| RHEL 4 | quagga +2 | 0.98.3-2.4.0.1.el4 | RHSA-2007:0389 |
| RHEL 3 | quagga | 0.96.2-12.3E | RHSA-2007:0389 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | quagga | 1.2.4-2.14 | openSUSE-SU-2024:11290-1 |
Advisories 3
- RHSA-2007:0389 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1293-1 quagga Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11290-1 libfpm_pb0-1.2.4-2.14 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1018142 vdb-entry
- 25119 third-party-advisory
- 25084 third-party-advisory
- 25312 third-party-advisory
- ADV-2007-1336 vdb-entry
- ADV-2008-1195 vdb-entry
- 23417 vdb-entry
- 236141 vendor-advisory
- DSA-1293 vendor-advisory
- 24808 third-party-advisory
- 25428 third-party-advisory
- http://bugzilla.quagga.net/show_bug.cgi?id=354
- 2007-0017 vendor-advisory
- OpenPKG-SA-2007.015 vendor-advisory
- RHSA-2007:0389 vendor-advisory
- SUSE-SR:2007:009 vendor-advisory
- oval:org.mitre.oval:def:11048 vdb-entry signature
- http://www.quagga.net/news2.php?y=2007&m=4&d=8#id1176073740
- 25293 third-party-advisory
- quagga-bgpattributes-dos(33547) vdb-entry
- 29743 third-party-advisory
- USN-461-1 vendor-advisory
- http://bugzilla.quagga.net/show_bug.cgi?id=355
- MDKSA-2007:096 vendor-advisory
- 25255 third-party-advisory
- GLSA-200705-05 vendor-advisory