CVE-2017-16227: Input Validation
Published Oct 29, 2017
·Updated
The aspathput function in bgpd/bgpaspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because ASPATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.
Affected Software
3 affected components
Quagga Quagga<=1.2.1
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Patch Available
Event History
Oct 29, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-16227?
CVE-2017-16227 is classified as a denial of service vulnerability.
2
How do I fix CVE-2017-16227?
To fix CVE-2017-16227, upgrade Quagga to version 1.2.2 or later.
3
What are the affected versions for CVE-2017-16227?
CVE-2017-16227 affects Quagga versions prior to 1.2.2 and specific Debian Linux versions 8.0 and 9.0.
4
Can CVE-2017-16227 be exploited remotely?
Yes, CVE-2017-16227 can be exploited by remote attackers through specially crafted BGP UPDATE messages.
5
What type of attack does CVE-2017-16227 facilitate?
CVE-2017-16227 can facilitate a denial of service attack resulting in session drops.