Bug 1542990 (CVE-2018-5380) - CVE-2018-5380 quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash
Summary: CVE-2018-5380 quagga: bgpd can overrun internal BGP code-to-string conversion...
Alias: CVE-2018-5380
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1546005 1546006
Blocks: 1543001
TreeView+ depends on / blocked
Reported: 2018-02-07 14:13 UTC by Adam Mariš
Modified: 2021-03-11 17:08 UTC (History)
7 users (show)

Fixed In Version: quagga 1.2.3
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Quagga, in the log formatting code. Specially crafted messages sent by BGP peers could cause Quagga to read one element past the end of certain static arrays, causing arbitrary binary data to appear in the logs or potentially, a crash.
Clone Of:
Last Closed: 2019-06-08 03:39:27 UTC

Attachments (Terms of Use)
Upstream patch (3.83 KB, patch)
2018-02-07 14:24 UTC, Adam Mariš
no flags Details | Diff

Description Adam Mariš 2018-02-07 14:13:58 UTC
The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

The impact is thought to be very low. The bgpd daemon likely will continue
running. Warning and debug messages in the logs may contain arbitrary bytes.

The issue can only be triggered by a configured peer, if there is sufficient
transport security.

All versions of quagga are affected.

Comment 1 Adam Mariš 2018-02-07 14:14:01 UTC

Name: the Quagga project

Comment 2 Adam Mariš 2018-02-07 14:24:07 UTC
Created attachment 1392684 [details]
Upstream patch

Comment 3 Doran Moppert 2018-02-13 04:15:36 UTC
External References:


Comment 4 Doran Moppert 2018-02-13 05:02:27 UTC

Red Hat Product Security has given this vulnerability a rating of Low. We believe the potential for a crash on supported architectures is very small.

Comment 5 Doran Moppert 2018-02-16 04:37:17 UTC
Created quagga tracking bugs for this issue:

Affects: fedora-all [bug 1546006]

Note You need to log in before you can comment on or make changes to this bug.