APP: Quagga BGP Daemon Notify Attribute Out of Bounds Read
This signature detects attempt tp exploit an out of bounds read vulnerability which has been reported in Quagga BGP Daemon. The vulnerability is due to improper validation of attribute sizes received by BGP peers before responding with the contents of the attribute in a NOTIFY message. Successful exploitation could result in the disclosure of memory contents to the attacker. Unsuccessful exploitation could result in termination of the bgpd process.
Extended Description
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
Affected Products
Quagga quagga
References
CVE: CVE-2018-5378
Short Name
APP:MISC:QUAGGA-BGP-NOTIFY-OOB
Severity
Major
Recommended
True
Recommended Action
Drop
Category
APP
Keywords
Attribute BGP Bounds CVE-2018-5378 Daemon Notify Out Quagga Read of
Release Date
03/13/2018
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3590
False Positive
Unknown
Vendors
Quagga
Debian
Canonical
CVSS Score
4.9