CVE-2018-5378CWE-119

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid

High · published February 19, 2018

Patch now

High probability of exploitation

CVSS calls it high at 7.1. It sits in the 99.5th percentile for exploit probability.

CVSS v3.0
7.1
EPSS
74%
Percentile
99.5
In the wild
Unconfirmed
What it is

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.74200 · 99.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2018-02-19T13:00Z
EPSS history
Timeline
  • 19 FEB 13:00Z
    The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid
    cvelistv5