Description: Paul Jakma has reported a vulnerability in Quagga, which can be exploited by malicious users to cause a DoS (Denial of Service).
The vulnerability is caused due to bgpd not checking the length information of the "MP_UNREACH_NLRI" and "MP_REACH_NLRI" attributes. This can be exploited to cause an assertion error or out of bounds read by sending a specially crafted UPDATE message.
Successful exploitation requires that the attacker is configured as peer of the victim system.
The vulnerability is reported in all existing Quagga versions.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
