CVE-2003-0858 Denial of service in n/a

Low 2.1 Published 18 Nov 2003 Updated 8 Aug 2024

Local attackers can cause a denial of service in Zebra and Quagga by sending spoofed messages to the kernel netlink interface.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2003-0858?

CVE-2003-0858 is a low-severity denial of service vulnerability in n/a, published on 18 Nov 2003. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.

Weakness: CWE-399

Which versions are affected by CVE-2003-0858?

It affects 2 products.

Linux distribution packages (4)

`quagga` Red Hat:enterprise_linux:3::as	All versions	`0:0.96.2-8.3E`
`quagga-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`0:0.96.2-8.3E`
`quagga` Red Hat:enterprise_linux:3::es	All versions	`0:0.96.2-8.3E`
`quagga-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`0:0.96.2-8.3E`

Products include Gnu Zebra, Quagga Quagga Routing Software Suite.

How do I fix CVE-2003-0858?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2003-0858 being exploited?

There is no known exploitation of CVE-2003-0858 in the wild and no public exploit code.

CVE-2003-0795 Null dereference in n/a Medium 5.0

Sources

Also known as GHSA-44r4-q6xp-rh44, RHSA-2003:315.