Description
bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | quagga | 0.99.5-5etch3 | DSA-1382-1 |
| Debian 3.1 | quagga | 0.98.3-7.5 | DSA-1382-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | quagga +2 | 0.98.6-5.el5_5.2 | RHSA-2010:0785 |
| RHEL 4 | quagga +2 | 0.98.3-4.el4_8.1 | RHSA-2010:0785 |
Advisories 2
- RHSA-2010:0785 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1382-1 quagga Debian Security (DSA / DLA) · Mar 9, 2026
References
- quagga-bgpd-dos(36551) vdb-entry
- http://quagga.net/news2.php?y=2007&m=9&d=7#id1189190760
- http://www.quagga.net/download/quagga-0.99.9.changelog.txt
- ADV-2008-1195 vdb-entry
- 26744 third-party-advisory
- 236141 vendor-advisory
- ADV-2007-3129 vdb-entry
- 26863 third-party-advisory
- 2007-0028 vendor-advisory
- FEDORA-2007-2196 vendor-advisory
- 29743 third-party-advisory
- 26829 third-party-advisory
- RHSA-2010:0785 vendor-advisory
- USN-512-1 vendor-advisory
- MDKSA-2007:182 vendor-advisory
- DSA-1382 vendor-advisory
- 25634 vdb-entry
- [debian-security-announce] 20071003 [SECURITY] [DSA 1379-1] New quagga packages fix denial of service mailing-list
- 27049 third-party-advisory