Siemens RUGGEDCOM ROX II
The shipped version of the Quagga BGP daemon (bgpd) can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. The security vulnerability could be exploited by an attacker spoofing a malicious BGP UPDATE message within the network. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality, integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. The shipped version of the Quagga BGP daemon (bgpd) can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. The security vulnerability could be exploited by an attacker spoofing a malicious BGP code-point. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. An attacker could use the vulnerability to insert binary data into the internal log files. At the time of advisory publication no public exploitation of this security vulnerability was known. The shipped version of the Quagga BGP daemon (bgpd) has a bug in its parsing of "Capabilities" in BGP OPEN messages. The parser can enter an infinite loop on invalid capabilities causing a denial of service. The security vulnerability could be exploited by an attacker spoofing a malicious BGP OPEN message. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.