The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2981 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)

    * frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)

    * frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)

    * frr: mishandled malformed data leading to a crash (CVE-2023-46752)

    * frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3573 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3573-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     September 19, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : frr     Version        : 7.5.1-1.1+deb10u1     CVE ID         : CVE-2022-36440 CVE-2022-40302 CVE-2022-40318 CVE-2022-43681                      CVE-2023-31490 CVE-2023-38802 CVE-2023-41358 CVE-2023-41360                      CVE-2023-41361 CVE-2023-41909     Debian Bug     : 1035829 1036062

    Multiple security vulnerabilities were found in frr, the FRRouting suite     of internet protocols. Maliciously constructed Border Gateway Protocol     (BGP) packages or corrupted tunnel attributes may cause a denial of service     (application crash) which could be exploited by a remote attacker.

    For Debian 10 buster, these problems have been fixed in version     7.5.1-1.1+deb10u1.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-514db5339e advisory.

    New version 8.5.3.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0036 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-38406:
    bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow.

    CVE-2023-38407:
    bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing.

    CVE-2023-38802:
    FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of     service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

    CVE-2023-41358:
    An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero.

    CVE-2023-41359:
    An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation.

    CVE-2023-41360:
    An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the     ORF header in an ahead-of-stream situation.

    CVE-2023-41361:
    An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of     the rcv software version.

    CVE-2023-41909:
    An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference.

    CVE-2023-46752:
    An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash.

    CVE-2023-46753:
    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute.

    CVE-2023-3748:
    A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be     ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag     set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter     an infinite loop and cause a denial of service.

    CVE-2023-31490:
    An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2981 advisory.

    [7.5.1-22.0.1]
    - Fix POSTIN scriptlet [Orabug: 34712485]
    - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
    - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
    - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
    - Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message

    [7.5.1-22]
    - Resolves: RHEL-22303 - Zebra not fetching host routes

    [7.5.1-21]
    - Resolves: RHEL-2216 - NULL pointer dereference

    [7.5.1-20]
    - Resolves: RHEL-4797 - missing length check in bgp_attr_psid_sub() can lead do DoS

    [7.5.1-19]
    - Resolves: RHEL-14824 - crafted BGP UPDATE message leading to a crash

    [7.5.1-18]
    - Resolves: RHEL-14821 - mishandled malformed data leading to a crash

    [7.5.1-17]
    - Resolves: RHEL-6583 - Routes are not refreshed after changing the inbound route rules from deny to     permit

    [7.5.1-16]
    - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
    - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
    - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
    - Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message

    [7.5.1-15]
    - Resolves: RHEL-12039 - crash in plist update

    [7.5.1-14]
    - Resolves: RHEL-6617 - Incorrect handling of a error in parsing of an invalid section of a BGP update can     de-peer a router

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4090-1 advisory.

    Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:

    - CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,       CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,       CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,       CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,       CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.
      See https://frrouting.org/release/8.5.6/ for details.

    The most recent frr 8.x series provides several new features,     improvements and bug fixes for various protocols and daemons,     especially for PIM/PIMv6/BGP and VRF support.

    See https://frrouting.org/release/8.5/ for details and links.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3762-1 advisory.

    - CVE-2023-38802: Fixed bad length handling when processing BGP attributes. (bsc#1213284)
    - CVE-2023-41358: Fixed a possible crash when processing NLRIs with an attribute length of zero.
    (bsc#1214735)
    - CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec     (bsc#1215065).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0141 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-31490:
    An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function.

    CVE-2023-41358:
    An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero.

    CVE-2023-41909:
    An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference.

    CVE-2023-46752:
    An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash.

    CVE-2023-46753:
    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3709-1 advisory.

    - CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).
    - CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).
    - CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).
    - CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).
    - CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec     (bsc#1215065).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6432-1 advisory.

    It was discovered that the Quagga BGP daemon did not properly check the attribute length in NRLI. A remote     attacker could possibly use this issue to cause a denial of service. (CVE-2023-41358)

    It was discovered that the Quagga BGP daemon did not properly manage memory when reading initial bytes of     ORF header. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-41360)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce436d56f8 advisory.

    New version 8.5.3.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2156 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)

    * frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)

    * frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)

    * frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)

    * frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)

    * frr: mishandled malformed data leading to a crash (CVE-2023-46752)

    * frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

    * frr: ahead-of-stream read of ORF header (CVE-2023-41360)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5495 advisory.

  - A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function.
    Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd,     resulting in DoS. (CVE-2022-36440)

  - An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an     option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion     failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary     checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. (CVE-2022-40302)

  - An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an     option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion     failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary     checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior     occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack     vector) relative to CVE-2022-40302. (CVE-2022-40318)

  - An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP     OPEN message that ends with the option length octet (or the option length word, in case of an extended     OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and     exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition. (CVE-2022-43681)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

  - FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of     service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). (CVE-2023-38802)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3793-1 advisory.

    - CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284).
      - CVE-2023-41358: Fixed possible crash when processing NLRIs if the attribute length is zero     (bsc#1214735).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0184 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-31490:
    An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function.

    CVE-2023-41358:
    An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero.

    CVE-2023-41909:
    An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference.

    CVE-2023-46752:
    A data mishandling vulnerability was found in FRRouting. A malformed MP_REACH_NLRI data can lead to a     crash, resulting in a denial of service.

    CVE-2023-46753:
    A flaw was found in FRRouting. A crash can occur for a crafted BGP UPDATE message without mandatory     attributes (for example, one with only an unknown transit attribute).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2981 advisory.

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash. (CVE-2023-46752)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute. (CVE-2023-46753)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2156 advisory.

    [8.5.3-4]
    - Resolves: RHEL-14825 - crafted BGP UPDATE message leading to a crash

    [8.5.3-3]
    - Resolves: RHEL-14822 - mishandled malformed data leading to a crash

    [8.5.3-2]
    - Resolves: RHEL-15915 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
    - Resolves: RHEL-15918 - crash from malformed EOR-containing BGP UPDATE message

    [8.5.3-1]
    - Resolves: RHEL-15291 - Rebase FRR to version 8.5.3 in RHEL9

    [8.3.1-12]
    - Resolves: RHEL-3541 - Incorrect handling of a error in parsing of an invalid section of a BGP update can     de-peer a router

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
197804	RHEL 8 : frr (RHSA-2024:2981)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/3/22	high
181647	Debian dla-3573 : frr - security update	Nessus	Debian Local Security Checks	2023/9/20	2025/1/22	critical
185611	Fedora 39 : frr (2023-514db5339e)	Nessus	Fedora Local Security Checks	2023/11/14	2024/11/14	critical
239889	TencentOS Server 4: frr (TSSA-2024:0036)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
197991	Oracle Linux 8 : frr (ELSA-2024-2981)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2025/9/9	high
212585	SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2024:4090-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/6/26	critical
181868	SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2023:3762-1)	Nessus	SuSE Local Security Checks	2023/9/26	2026/6/26	high
235969	Alibaba Cloud Linux 3 : 0141: frr (ALINUX3-SA-2024:0141)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
181739	SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2023:3709-1)	Nessus	SuSE Local Security Checks	2023/9/21	2026/6/26	critical
183230	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Quagga vulnerabilities (USN-6432-1)	Nessus	Ubuntu Local Security Checks	2023/10/17	2024/8/28	critical
185610	Fedora 37 : frr (2023-ce436d56f8)	Nessus	Fedora Local Security Checks	2023/11/14	2024/11/15	critical
194782	RHEL 9 : frr (RHSA-2024:2156)	Nessus	Red Hat Local Security Checks	2024/4/30	2024/11/7	critical
181250	Debian DSA-5495-1 : frr - security update	Nessus	Debian Local Security Checks	2023/9/11	2023/9/11	high
181905	SUSE SLES12: libospf0 / libospfapiclient0 / libquagga_pb0 / libzebra1 / quagga / etc (SUSE-SU-2023:3793-1)	Nessus	SuSE Local Security Checks	2023/9/27	2026/6/26	high
238898	TencentOS Server 3: frr (TSSA-2024:0184)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
197686	CentOS 8 : frr (CESA-2024:2981)	Nessus	CentOS Local Security Checks	2024/5/22	2024/5/22	high
195033	Oracle Linux 9 : frr (ELSA-2024-2156)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	critical

检测

插件搜索

high

critical

critical

critical

high

critical

high

high

critical

critical

critical

critical

high

high

high

high

critical