Bug 1542990 (CVE-2018-5380) - CVE-2018-5380 quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash
Summary: CVE-2018-5380 quagga: bgpd can overrun internal BGP code-to-string conversion...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-5380
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1546005 1546006
Blocks: 1543001
TreeView+ depends on / blocked
 
Reported: 2018-02-07 14:13 UTC by Adam Mariš
Modified: 2021-03-11 17:08 UTC (History)
7 users (show)

Fixed In Version: quagga 1.2.3
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Quagga, in the log formatting code. Specially crafted messages sent by BGP peers could cause Quagga to read one element past the end of certain static arrays, causing arbitrary binary data to appear in the logs or potentially, a crash.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:39:27 UTC
Embargoed:

Attachments (Terms of Use)
Upstream patch (3.83 KB, patch)
2018-02-07 14:24 UTC, Adam Mariš 		no flags Details | Diff
View All

Description Adam Mariš 2018-02-07 14:13:58 UTC 
The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

The impact is thought to be very low. The bgpd daemon likely will continue
running. Warning and debug messages in the logs may contain arbitrary bytes.

The issue can only be triggered by a configured peer, if there is sufficient
transport security.

All versions of quagga are affected.
Comment 1 Adam Mariš 2018-02-07 14:14:01 UTC 
Acknowledgments:

Name: the Quagga project
Comment 2 Adam Mariš 2018-02-07 14:24:07 UTC 
Created attachment 1392684 [details]
Upstream patch
Comment 3 Doran Moppert 2018-02-13 04:15:36 UTC 
External References:

https://www.quagga.net/security/Quagga-2018-1550.txt
Comment 4 Doran Moppert 2018-02-13 05:02:27 UTC 
Statement:

Red Hat Product Security has given this vulnerability a rating of Low. We believe the potential for a crash on supported architectures is very small.
Comment 5 Doran Moppert 2018-02-16 04:37:17 UTC 
Created quagga tracking bugs for this issue:

Affects: fedora-all [bug 1546006]
Note You need to log in before you can comment on or make changes to this bug.