The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Link | Tags |
---|---|
https://bugs.debian.org/879474 | issue tracking third party advisory patch |
http://download.savannah.gnu.org/releases/quagga/quagga-1.2.2.changelog.txt | issue tracking third party advisory |
http://www.debian.org/security/2017/dsa-4011 | issue tracking third party advisory vendor advisory |
https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d98833069a88e6fddb9285008 | issue tracking third party advisory patch |
https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html | issue tracking third party advisory patch |