This update for quagga fixes the following issues :

  - CVE-2017-16227: Fixed bgpd DoS via specially crafted BGP     UPDATE messages (boo#1065641)

  - CVE-2018-5378: Fixed bgpd bounds check issue via     attribute length (Quagga-2018-0543,boo#1079798)

  - CVE-2018-5379: Fixed bgpd double free when processing     UPDATE message (Quagga-2018-1114,boo#1079799)

  - CVE-2018-5380: Fixed bgpd code-to-string conversion     tables overrun (Quagga-2018-1550,boo#1079800)

  - CVE-2018-5381: Fixed bgpd infinite loop on certain     invalid OPEN messages (Quagga-2018-1975,boo#1079801)

Infinite loop issue triggered by invalid OPEN message allows denial-of-service

An infinite loop vulnerability was discovered in Quagga. A BGP peer could send specially crafted packets that would cause the daemon to enter an infinite loop, denying service and consuming CPU until it is restarted.(CVE-2018-5381)

Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code

A double-free vulnerability was found in Quagga. A BGP peer could send a specially crafted UPDATE message which would cause allocated blocks of memory to be free()d more than once, potentially leading to a crash or other issues.(CVE-2018-5379)

bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash

A vulnerability was found in Quagga, in the log formatting code.
Specially crafted messages sent by BGP peers could cause Quagga to read one element past the end of certain static arrays, causing arbitrary binary data to appear in the logs or potentially, a crash.(CVE-2018-5380)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0377 advisory.

  - quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to     crash or potentially execute arbitrary code (CVE-2018-5379)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has quagga packages installed that are affected by a vulnerability:

  - A double-free vulnerability was found in Quagga. A BGP     peer could send a specially crafted UPDATE message which     would cause allocated blocks of memory to be free()d     more than once, potentially leading to a crash or other     issues. (CVE-2018-5379)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for quagga fixes the following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3573-1 advisory.

    It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing     certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly     execute arbitrary code. (CVE-2018-5379)

    It was discovered that the Quagga BGP daemon did not properly bounds check the data sent with a NOTIFY to     a peer. An attacker could use this to expose sensitive information or possibly cause a denial of service.
    This issue only affected Ubuntu 17.10. (CVE-2018-5378)

    It was discovered that a table overrun vulnerability existed in the Quagga BGP daemon. An attacker in     control of a configured peer could use this to possibly expose sensitive information or possibly cause a     denial of service. (CVE-2018-5380)

    It was discovered that the Quagga BGP daemon in some configurations did not properly handle invalid OPEN     messages. An attacker in control of a configured peer could use this to cause a denial of service     (infinite loop). (CVE-2018-5381)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms     of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a     denial of service or potentially allow an attacker to execute arbitrary code. (CVE-2018-5379)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3426-1 advisory.

    - CVE-2017-15865: sensitive information disclosed when malformed BGP UPDATE packets are processed.
    (bsc#1230866)
    - CVE-2024-44070: crash when parsing Tunnel Encap attribute due to no length check. (bsc#1229438)
    - CVE-2022-37032: out-of-bounds read when parsing a BGP capability message due to incorrect size check.
    (bsc#1202023)

    Bug fixes:
    - References to /var/adm/fillup-templates replaced with new %_fillupdir macro. (bsc#1069468)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2018-2582:01 advisory.

    * quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to     crash or potentially execute arbitrary code (CVE-2018-5379)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for quagga is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code (CVE-2018-5379)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Quagga project for reporting this issue.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A double-free vulnerability was found in Quagga. A BGP     peer could send a specially crafted UPDATE message     which would cause allocated blocks of memory to be     free()d more than once, potentially leading to a crash     or other issues.(CVE-2018-5379)

  - All versions of Quagga, 0.93 through 1.1.0, are     vulnerable to an unbounded memory allocation in the     telnet 'vty' CLI, leading to a Denial-of-Service of     Quagga daemons, or even the entire host. When Quagga     daemons are configured with their telnet CLI enabled,     anyone who can connect to the TCP ports can trigger     this vulnerability, prior to authentication. Most     distributions restrict the Quagga telnet interface to     local access only by default. The Quagga telnet     interface 'vty' input buffer grows automatically,     without bound, so long as a newline is not entered.
    This allows an attacker to cause the Quagga daemon to     allocate unbounded memory by sending very long strings     without a newline. Eventually the daemon is terminated     by the system, or the system itself runs out of     memory.(CVE-2017-5495)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Quagga, a routing daemon. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-5378     It was discovered that the Quagga BGP daemon, bgpd, does     not properly bounds check data sent with a NOTIFY to a     peer, if an attribute length is invalid. A configured     BGP peer can take advantage of this bug to read memory     from the bgpd process or cause a denial of service     (daemon crash).

  https://www.quagga.net/security/Quagga-2018-0543.txt

  - CVE-2018-5379     It was discovered that the Quagga BGP daemon, bgpd, can     double-free memory when processing certain forms of     UPDATE message, containing cluster-list and/or unknown     attributes, resulting in a denial of service (bgpd     daemon crash).

  https://www.quagga.net/security/Quagga-2018-1114.txt

  - CVE-2018-5380     It was discovered that the Quagga BGP daemon, bgpd, does     not properly handle internal BGP code-to-string     conversion tables.

  https://www.quagga.net/security/Quagga-2018-1550.txt

  - CVE-2018-5381     It was discovered that the Quagga BGP daemon, bgpd, can     enter an infinite loop if sent an invalid OPEN message     by a configured peer. A configured peer can take     advantage of this flaw to cause a denial of service     (bgpd daemon not responding to any other events; BGP     sessions will drop and not be reestablished;
    unresponsive CLI interface).

  https://www.quagga.net/security/Quagga-2018-1975.txt

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0377 advisory.

    - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing       certain forms of UPDATE message allowing to crash or potentially execute       arbitrary code

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - quagga: Double free vulnerability in bgpd when     processing certain forms of UPDATE message allowing to     crash or potentially execute arbitrary code     (CVE-2018-5379)

Quagga reports :

The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid.
Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash.

The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.

The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

The Quagga BGP daemon, bgpd, can enter an infinite loop if sent an invalid OPEN message by a configured peer.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
106895	openSUSE Security Update : quagga (openSUSE-2018-177)	Nessus	SuSE Local Security Checks	2018/2/20	2025/10/29	critical
106934	Amazon Linux AMI : quagga (ALAS-2018-957)	Nessus	Amazon Linux Local Security Checks	2018/2/22	2025/10/29	critical
107081	RHEL 7 : quagga (RHSA-2018:0377)	Nessus	Red Hat Local Security Checks	2018/3/1	2025/10/27	critical
127158	NewStart CGSL MAIN 5.04 : quagga Vulnerability (NS-SA-2019-0010)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/12/6	critical
106868	SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)	Nessus	SuSE Local Security Checks	2018/2/16	2025/10/29	critical
106869	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3573-1)	Nessus	Ubuntu Local Security Checks	2018/2/16	2025/9/3	critical
222637	Linux Distros Unpatched Vulnerability : CVE-2018-5379	Nessus	Misc.	2025/3/4	2025/9/2	critical
207715	SUSE SLES12: libfpm_pb0 / libospf0 / libospfapiclient0 / libquagga_pb0 / etc (SUSE-SU-2024:3426-1)	Nessus	SuSE Local Security Checks	2024/9/25	2026/6/25	critical
288981	MiracleLinux 7 : quagga-0.99.22.4-5.el7 (AXSA:2018-2582:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	critical
107174	Fedora 26 : quagga (2018-b3e985489b)	Nessus	Fedora Local Security Checks	2018/3/7	2025/10/27	critical
107269	CentOS 7 : quagga (CESA-2018:0377)	Nessus	CentOS Local Security Checks	2018/3/12	2025/10/24	critical
108469	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2018-1065)	Nessus	Huawei Local Security Checks	2018/3/20	2025/1/28	critical
106854	Debian DSA-4115-1 : quagga - security update	Nessus	Debian Local Security Checks	2018/2/16	2025/10/29	critical
107079	Oracle Linux 7 : quagga (ELSA-2018-0377)	Nessus	Oracle Linux Local Security Checks	2018/3/1	2025/10/27	critical
107083	Scientific Linux Security Update : quagga on SL7.x x86_64 (20180228)	Nessus	Scientific Linux Local Security Checks	2018/3/1	2025/10/27	critical
106859	FreeBSD : quagga -- several security issues (e15a22ce-f16f-446b-9ca7-6859350c2e75)	Nessus	FreeBSD Local Security Checks	2018/2/16	2025/10/29	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical