CVE-2007-1995

Severity: medium (CVSS 6.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-04-12 · updated 2026-06-16
Weakness: CWE-20

Description

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Affected products

quagga: through 0.98.6; 0.95, 0.96, 0.96.1, 0.96.2, 0.96.3, 0.96.4 (+13)

References

http://bugzilla.quagga.net/show_bug.cgi?id=354
http://bugzilla.quagga.net/show_bug.cgi?id=355
http://secunia.com/advisories/24808
http://secunia.com/advisories/25084
http://secunia.com/advisories/25119
http://secunia.com/advisories/25255
http://secunia.com/advisories/25293
http://secunia.com/advisories/25312
http://secunia.com/advisories/25428
http://secunia.com/advisories/29743
http://security.gentoo.org/glsa/glsa-200705-05.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-26-236141-1

Get alerted when CVE-2007-1995 or the next vulnerability affects your stack