Bug 1542990 (CVE-2018-5380)

Summary: CVE-2018-5380 quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: balajig81, bennie.joubert, jaskalnik, mruprich, msekleta, security-response-team, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: quagga 1.2.3 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Quagga, in the log formatting code. Specially crafted messages sent by BGP peers could cause Quagga to read one element past the end of certain static arrays, causing arbitrary binary data to appear in the logs or potentially, a crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:39:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1546005, 1546006    
Bug Blocks: 1543001    
Attachments:
Description Flags
Upstream patch none

Description Adam Mariš 2018-02-07 14:13:58 UTC 
The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

The impact is thought to be very low. The bgpd daemon likely will continue
running. Warning and debug messages in the logs may contain arbitrary bytes.

The issue can only be triggered by a configured peer, if there is sufficient
transport security.

All versions of quagga are affected.
Comment 1 Adam Mariš 2018-02-07 14:14:01 UTC 
Acknowledgments:

Name: the Quagga project
Comment 2 Adam Mariš 2018-02-07 14:24:07 UTC 
Created attachment 1392684 [details]
Upstream patch
Comment 3 Doran Moppert 2018-02-13 04:15:36 UTC 
External References:

https://www.quagga.net/security/Quagga-2018-1550.txt
Comment 4 Doran Moppert 2018-02-13 05:02:27 UTC 
Statement:

Red Hat Product Security has given this vulnerability a rating of Low. We believe the potential for a crash on supported architectures is very small.
Comment 5 Doran Moppert 2018-02-16 04:37:17 UTC 
Created quagga tracking bugs for this issue:

Affects: fedora-all [bug 1546006]