7.5

CVE-2016-4049

The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Quagga ≫ Quagga Version-
Opensuse ≫ Leap Version42.1
Opensuse ≫ Opensuse Version13.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.64% 0.906
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://rhn.redhat.com/errata/RHSA-2017-0794.html
http://www.debian.org/security/2016/dsa-3654
http://lists.opensuse.org/opensuse-updates/2016-05/msg00062.html
http://www.openwall.com/lists/oss-security/2016/04/27/7
http://www.securityfocus.com/bid/88561
http://www.securitytracker.com/id/1035699
https://lists.quagga.net/pipermail/quagga-dev/2016-February/014743.html
https://lists.quagga.net/pipermail/quagga-dev/2016-January/014699.html
https://security.gentoo.org/glsa/201701-48