CVE-2018-5378 : Security Advisory and Response

Version 1.2.3 and earlier of the Quagga BGP daemon (bgpd) has a vulnerability where it fails to adequately validate the data included in a NOTIFY message to a peer if the attribute length is not valid. This can result in the transmission of unintended data from the bgpd process to a peer, and potential crashes of bgpd.

Understanding CVE-2018-5378

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

What is CVE-2018-5378?

Vulnerability in Quagga BGP daemon (bgpd) versions 1.2.3 and earlier
Failure to validate data in a NOTIFY message can lead to data transmission issues and potential crashes

The Impact of CVE-2018-5378

CVSS Base Score: 7.1 (High)
CVSS Base Severity: High
Attack Vector: Network
Availability Impact: High
CWE ID: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Technical Details of CVE-2018-5378

The technical details of the CVE-2018-5378 vulnerability are as follows:

Vulnerability Description

Quagga BGP daemon (bgpd) fails to validate data in a NOTIFY message
Invalid attribute length can lead to unintended data transmission and potential crashes

Affected Systems and Versions

Product: bgpd
Vendor: Quagga
Versions Affected: < 1.2.3
Version Type: Custom (bpgd)

Exploitation Mechanism

Low attack complexity
Low privileges required
No user interaction needed
Scope remains unchanged

Mitigation and Prevention

To address CVE-2018-5378, consider the following mitigation strategies:

Immediate Steps to Take

Update Quagga BGP daemon to version 1.2.3 or later
Monitor network traffic for any unusual data transmissions

Long-Term Security Practices

Regularly update software and apply security patches
Conduct security audits to identify vulnerabilities

Patching and Updates

Apply patches provided by Quagga to fix the vulnerability
Stay informed about security advisories from relevant vendors