CVE-2012-0255 Denial of service in n/a
Remote attackers can cause a denial of service in Quagga bgpd by sending malformed BGP OPEN messages, crashing the daemon.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-0255?
CVE-2012-0255 is a medium-severity denial of service vulnerability in n/a, published on 5 Apr 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).
Weakness: CWE-119
Which versions are affected by CVE-2012-0255?
It affects 1 product.
Products include Quagga Quagga.
How do I fix CVE-2012-0255?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2012-0255 being exploited?
There is no known exploitation of CVE-2012-0255 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6f58-2f4p-jjcw.