The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1369:01 advisory.

    Quagga is a free software that manages TCP/IP based routing     protocol. It takes multi-server and multi-thread approach to resolve     the current complexity of the Internet.
    Quagga supports BGP4, BGP4 , OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng.
    Quagga is intended to be used as a Route Server and a Route Reflector. It is     not a toolkit, it provides full routing power under a new architecture.
    Quagga by design has a process for each protocol.
    Quagga is a fork of GNU Zebra.
    Security issues fixed with this release:
    CVE-2013-2236     Stack-based buffer overflow in the new_msg_lsa_change_notify function     in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when
    --enable-opaque-lsa and the -a command line option are used, allows     remote attackers to cause a denial of service (crash) via a large LSA.
    CVE-2016-1245     It was discovered that the zebra daemon in Quagga before 1.0.20161017     suffered from a stack-based buffer overflow when processing IPv6     Neighbor Discovery messages. The root cause was relying on BUFSIZ to be     compatible with a message size; however, BUFSIZ is system-dependent.
    CVE-2016-2342     The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI     parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4     configuration is used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers to execute     arbitrary code or cause a denial of service (stack-based buffer     overflow) via a crafted packet.
    CVE-2016-4049     The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does     not perform size checks when dumping data, which might allow remote     attackers to cause a denial of service (assertion failure and daemon     crash) via a large BGP packet.
    CVE-2017-5495     All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an     unbounded memory allocation in the telnet 'vty' CLI, leading to a     Denial-of-Service of Quagga daemons, or even the entire host. When     Quagga daemons are configured with their telnet CLI enabled, anyone who     can connect to the TCP ports can trigger this vulnerability, prior to     authentication. Most distributions restrict the Quagga telnet interface     to local access only by default. The Quagga telnet interface 'vty'     input buffer grows automatically, without bound, so long as a newline     is not entered. This allows an attacker to cause the Quagga daemon to     allocate unbounded memory by sending very long strings without a     newline. Eventually the daemon is terminated by the system, or the     system itself runs out of memory. This is fixed in Quagga 1.1.1 and     Free Range Routing (FRR) Protocol Suite 2017-01-10.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping     data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash)     via a large BGP packet. (CVE-2016-4049)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer
    overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be
    compatible with a message size; however, BUFSIZ is system-dependent. (CVE-2016-1245)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping
    data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash)
    via a large BGP packet. (CVE-2016-4049)

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has quagga packages installed that are affected by multiple vulnerabilities:

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash. (CVE-2017-5495)

  - A stack-based buffer overflow flaw was found in the way     Quagga handled IPv6 router advertisement messages. A     remote attacker could use this flaw to crash the zebra     daemon resulting in denial of service. (CVE-2016-1245)

  - A denial of service flaw was found in the Quagga BGP     routing daemon (bgpd). Under certain circumstances, a     remote attacker could send a crafted packet to crash the     bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

  - A stack-based buffer overflow flaw was found in the way     the Quagga BGP routing daemon (bgpd) handled Labeled-VPN     SAFI routes data. A remote attacker could use this flaw     to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-2342)

  - A stack-based buffer overflow flaw was found in the way     the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this     flaw to crash the ospfd daemon resulting in denial of     service. (CVE-2013-2236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A stack-based buffer overflow flaw was found in the way     Quagga handled IPv6 router advertisement messages. A     remote attacker could use this flaw to crash the zebra     daemon resulting in denial of service. (CVE-2016-1245)

  - A stack-based buffer overflow flaw was found in the way     the Quagga BGP routing daemon (bgpd) handled Labeled-VPN     SAFI routes data. A remote attacker could use this flaw     to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-2342)

  - A denial of service flaw was found in the Quagga BGP     routing daemon (bgpd). Under certain circumstances, a     remote attacker could send a crafted packet to crash the     bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash. (CVE-2017-5495)

  - A stack-based buffer overflow flaw was found in the way     the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this     flaw to crash the ospfd daemon resulting in denial of     service. (CVE-2013-2236)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0794 advisory.

    - Resolves: #1416013 - CVE-2017-5495 quagga: Telnet interface input buffer allocates unbounded amounts of     memory
    - fix for CVE-2013-2236 (#1391918)
    - fix for CVE-2016-1245 (#1391914)
    - fix for CVE-2016-2342 (#1391916)
    - fix for CVE-2016-4049 (#1391919)
    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0794 advisory.

    The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based     protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is     intended to be used as a Route Server and Route Reflector.

    Security Fix(es):

    * A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement     messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service.
    (CVE-2016-1245)

    * A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled     Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in     denial of service. (CVE-2016-2342)

    * A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances,     a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

    * A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this     flaw to cause the various Quagga daemons, which expose their telnet interface, to crash. (CVE-2017-5495)

    * A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in     denial of service. (CVE-2013-2236)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes     and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-48 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted packet possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update addresses multiple security problems and fixes systemd dependencies.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3102-1 advisory.

    It was discovered that Quagga incorrectly handled dumping data. A remote attacker could possibly use a     large BGP packet to cause Quagga to crash, resulting in a denial of service. (CVE-2016-4049)

    It was discovered that the Quagga package incorrectly set permissions on the configuration directory. A     local user could use this issue to possibly obtain sensitive information. (CVE-2016-4036)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The quagga package installs world readable sensitive files in /etc/quagga, and might be subject to denial of service because of lacking packet size checks.

CVE-2016-4036

The quagga package before 0.99.23-2.6.1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.

CVE-2016-4049

The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.

For Debian 7 'Wheezy', these problems have been fixed in version 0.99.22.4-1+wheezy3.

We recommend that you upgrade your quagga packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in quagga, a BGP/OSPF/RIP routing daemon.

  - CVE-2016-4036     Tamas Nemeth discovered that sensitive configuration     files in /etc/quagga were world-readable despite     containing sensitive information.

  - CVE-2016-4049     Evgeny Uskov discovered that a bgpd instance handling     many peers could be crashed by a malicious user when     requesting a route dump.

This update for quagga fixes the following security issues :

  - CVE-2016-4049: Remote crash vulnerability with specially     crafted packages due to a buffer overflow error in     bgp_dump_routes_func (boo#977012)

ID	Name	Product	Family	Type	Severity
289473	MiracleLinux 4 : quagga-0.99.15-14.AXS4 (AXSA:2017-1369:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
219656	Linux Distros Unpatched Vulnerability : CVE-2016-4049	Nessus	Misc.	Local	high
400939	Alpine: multiple quagga packages: security update to 1.0.20160315-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
400939	Alpine: multiple quagga packages: security update to 1.0.20160315-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
146136	EulerOS 2.0 SP5 : quagga (EulerOS-SA-2021-1227)	Nessus	Huawei Local Security Checks	Local	high
132192	EulerOS 2.0 SP3 : quagga (EulerOS-SA-2019-2657)	Nessus	Huawei Local Security Checks	Local	critical
131900	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2019-2408)	Nessus	Huawei Local Security Checks	Local	critical
127329	NewStart CGSL MAIN 4.05 : quagga Multiple Vulnerabilities (NS-SA-2019-0101)	Nessus	NewStart CGSL Local Security Checks	Local	critical
99223	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20170321)	Nessus	Scientific Linux Local Security Checks	Local	critical
99073	Oracle Linux 6 : quagga (ELSA-2017-0794)	Nessus	Oracle Linux Local Security Checks	Local	critical
97961	CentOS 6 : quagga (CESA-2017:0794)	Nessus	CentOS Local Security Checks	Local	critical
97885	RHEL 6 : quagga (RHSA-2017:0794)	Nessus	Red Hat Local Security Checks	Local	critical
96683	GLSA-201701-48 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
95010	Fedora 25 : quagga (2016-8acc6b66f1)	Nessus	Fedora Local Security Checks	Local	critical
94526	Fedora 24 : quagga (2016-cae6456f63)	Nessus	Fedora Local Security Checks	Local	critical
94524	Fedora 23 : quagga (2016-568c7ff4f6)	Nessus	Fedora Local Security Checks	Local	critical
94068	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3102-1)	Nessus	Ubuntu Local Security Checks	Local	medium
93130	Debian DLA-601-1 : quagga security update	Nessus	Debian Local Security Checks	Local	medium
93117	Debian DSA-3654-1 : quagga - security update	Nessus	Debian Local Security Checks	Local	medium
91208	openSUSE Security Update : quagga (openSUSE-2016-591)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2016-4049

high

Tenable Plugins

critical

high

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

high