CVE-2016-4049: Input Validation
Published May 23, 2016
·Updated
The bgpdumproutesfunc function in bgpd/bgpdump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
Affected Software
3 affected components
Quagga Quagga
openSUSE Leap=42.1
openSUSE openSUSE=13.2
Event History
May 23, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4049?
CVE-2016-4049 is considered a medium severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2016-4049?
To fix CVE-2016-4049, update Quagga to a version that addresses this vulnerability.
3
What are the potential impacts of CVE-2016-4049?
The potential impacts of CVE-2016-4049 include assertion failures and daemon crashes when processing large BGP packets.
4
Which software is affected by CVE-2016-4049?
CVE-2016-4049 affects the Quagga routing software suite as well as its deployments on OpenSUSE 42.1 and 13.2.
5
Who can exploit CVE-2016-4049?
Remote attackers can exploit CVE-2016-4049 by sending large BGP packets to the affected service.