The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Quagga | Quagga | * | 1.2.2 (including) |
Red Hat Enterprise Linux 7 | RedHat | quagga-0:0.99.22.4-5.el7_4 | * |
Quagga | Ubuntu | artful | * |
Quagga | Ubuntu | devel | * |
Quagga | Ubuntu | trusty | * |
Quagga | Ubuntu | upstream | * |
Quagga | Ubuntu | xenial | * |