CVE-2018-5381CWE-228

The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the…

Medium · published February 19, 2018

CVSS v3.0

6.5

EPSS

30%

Percentile

98.2

In the wild

Unconfirmed

What it is

The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.

The record

Technical detail

CVSS v3.0: 6.5 · MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.30162 · 98.2th percentile
Weakness: CWE-228 · Improper Handling of Syntactically Invalid Structure
Published: 2018-02-19T13:00Z

EPSS history

Timeline

19 FEB 13:00Z
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the…
cvelistv5