Description
The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | quagga | 0.99.10-1lenny2 | DSA-1788-1 |
Advisories 1
- DSA-1788-1 quagga - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 54200 vdb-entry
- 35203 third-party-advisory
- 34999 third-party-advisory
- MDVSA-2009:109 vendor-advisory
- 1022164 vdb-entry
- USN-775-1 vendor-advisory
- [oss-security] 20090501 CVE request (sort of): Quagga BGP crasher mailing-list
- [quagga-dev] 20090203 [quagga-dev 6391] [PATCH] BGP 4-byte ASN bug fixes mailing-list
- http://thread.gmane.org/gmane.network.quagga.devel/6513
- DSA-1788 vendor-advisory
- quagga-systemnumber-dos(50317) vdb-entry
- 35685 third-party-advisory
- FEDORA-2009-5324 vendor-advisory
- 35061 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311
- FEDORA-2009-5284 vendor-advisory
- 34817 vdb-entry
- [oss-security] 20090501 Re: CVE request (sort of): Quagga BGP crasher mailing-list