CVE-2007-1995 - CVE House
Back to Database
Status published Medium CVE-2007-1995

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier...

Vulnerability Description

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-1995

Credits & Attribution

No credits recorded in the NVD database.

References

More from quagga

View All →
CVE-2021-44038
An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod...
High 7.8
CVE-2017-5495
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to...
High 7.5
CVE-2017-16227
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows...
High 7.5
CVE-2016-4049
The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform...
High 7.5
CVE-2016-2342
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser...
High 8.1

Affected Vendor

Affected Software

quagga
Vulnerable Versions:
0, 0.95, 0.96, 0.96.1, 0.96.2, 0.96.3, 0.96.4, 0.96.5, 0.97.0, 0.97.1, 0.97.2, 0.97.3, 0.97.4, 0.97.5, 0.98.0, 0.98.1, 0.98.2, 0.98.3, 0.98.4, 0.98.5

Timeline

Official Publish: April 12th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.