CVE-2018-5379
Summary
| CVE | CVE-2018-5379 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-02-19 13:29:00 UTC |
| Updated | 2019-10-09 23:41:00 UTC |
| Description | The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. |
Risk And Classification
Problem Types: CWE-415
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 17.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 17.10 | All | All | All |
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Quagga | Quagga | All | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Aus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.5 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.5 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Eus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.4 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Tus | 7.6 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 7.0 | All | All | All |
| Hardware | Siemens | Ruggedcom Rox Ii | - | All | All | All |
| Hardware | Siemens | Ruggedcom Rox Ii | - | All | All | All |
| Operating System | Siemens | Ruggedcom Rox Ii Firmware | All | All | All | All |
| Operating System | Siemens | Ruggedcom Rox Ii Firmware | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CERT Vulnerability Notes Database | CERT-VN | www.kb.cert.org | Third Party Advisory, US Government Resource |
| Quagga CVE-2018-5379 Remote Code Execution Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf | CONFIRM | cert-portal.siemens.com | Third Party Advisory |
| Debian -- Security Information -- DSA-4115-1 quagga | DEBIAN | www.debian.org | Third Party Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Third Party Advisory |
| [SECURITY] [DLA 1286-1] quagga security update | MLIST | lists.debian.org | Mailing List, Third Party Advisory |
| Quagga Routing Software - News: Quagga 1.2.3 Release, with significant BGP security fixes [Savannah] | CONFIRM | savannah.nongnu.org | Third Party Advisory |
| Quagga/quagga: Primary Quagga git repository - Quagga | CONFIRM | gogs.quagga.net | Vendor Advisory |
| Quagga: Multiple vulnerabilities (GLSA 201804-17) — Gentoo Security | GENTOO | security.gentoo.org | Third Party Advisory |
| USN-3573-1: Quagga vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.