CVE-2010-2948: Buffer Overflow
A stack buffer overflow flaw was found in the way Quagga's bgpd daemon processed Route-Refresh messages. A configured Border Gateway Protocol (BGP) peer could send a Route-Refresh message with specially-crafted Outbound Route Filtering (ORF) record, which would cause the master BGP daemon (bgpd) to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd.
Upstream changeset: [1] http://code.quagga.net/?p=quagga.git;a=commit;h=d64379e8f3c0636df53ed08d5b2f1946cfedd0e3
References: [2] http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100
CVE request: [3] http://www.openwall.com/lists/oss-security/2010/08/24/3
Other sources
Stack-based buffer overflow in the bgprouterefreshreceive function in bgppacket.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF) record in a BGP ROUTE-REFRESH (RR) message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2948?
CVE-2010-2948 is considered a high severity vulnerability due to its potential for a stack buffer overflow leading to code execution.
How do I fix CVE-2010-2948?
To fix CVE-2010-2948, upgrade Quagga to the latest version that addresses this vulnerability.
What versions of Quagga are affected by CVE-2010-2948?
CVE-2010-2948 affects multiple Quagga versions including 0.95, 0.96, 0.97.0, 0.98.0, and up to 0.99.16.
What kind of attack could exploit CVE-2010-2948?
An attacker could exploit CVE-2010-2948 by sending a crafted Route-Refresh message to trigger a buffer overflow in the bgpd daemon.
Is there a risk of data leakage with CVE-2010-2948?
Yes, CVE-2010-2948 may lead to data leakage or unauthorized access due to a successful exploit on the affected Quagga implementations.