CVE-2016-1245 It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ...
CriticalCVSS 9.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| quagga | <= 1.0.20160315 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- RHSA-2017:0794 vendor-advisory
- www.gossamer-threads.com mailing-list mitigation third-party-advisory
- 93775 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- GLSA-201701-48 vendor-advisory
- DSA-3695 third-party-advisory vendor-advisory