Buffer overflow in Quagga

CVE-2013-2236

Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.

Vulnerability class: Buffer Overflow

EPSS: 0.021 (79.6th percentile) — read the EPSS interpretation.

Affected products

Quagga — versions 0.99.22
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)