CVE-2017-16227

CWE-20 — Improper Input ValidationCWE-6829 documents7 sources
Severity
7.5HIGH
EPSS
0.8%
top 25.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Quagga QuaggaDebian Debian Linux
Timeline
PublishedOct 29
Latest updateMay 17

Description

The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Alpinequagga< 0.99.24.1-r6+3
▶Ubuntuquagga< 0.99.22.4-3ubuntu1.4+1
▶NVDquagga/quagga1.2.1

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: bugs.debian.org ↗Patch: git.savannah.gnu.org ↗Patch: lists.quagga.net ↗

🔴Vulnerability Details

4
GHSA
GHSA-8c9w-x87p-jr8v: The aspath_put function in bgpd/bgp_aspath↗2022-05-17
▶
OSV
quagga vulnerabilities↗2017-10-31
▶
CVEList
CVE-2017-16227: The aspath_put function in bgpd/bgp_aspath↗2017-10-29
▶
OSV
CVE-2017-16227: The aspath_put function in bgpd/bgp_aspath↗2017-10-29
▶

📋Vendor Advisories

2
Ubuntu
Quagga vulnerabilities↗2017-10-31
▶
Red Hat
quagga: Incorrect AS_PATH size calculation for long paths↗2017-10-02
▶

💬Community

2
Bugzilla
CVE-2017-16227 quagga: Incorrect AS_PATH size calculation for long paths↗2017-11-03
▶
Bugzilla
CVE-2017-16227 quagga: Incorrect AS_PATH size calculation for long paths [fedora-all]↗2017-11-03
▶
CVE-2017-16227 (HIGH CVSS 7.5) | The aspath_put function in bgpd/bgp | cvebase.io