bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes because of a mishandled attribute length, aka RN-690 (CM-18492).

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3524-1 advisory.

    This update for frr fixes the following issue:

    - Arithmetic overflow when parsing attribute of update packet due to regression introduced by the fix for       CVE-2017-15865. (bsc#1230866)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3478-1 advisory.

    - CVE-2017-15865: sensitive information disclosed when malformed BGP UPDATE packets are processed.
    (bsc#1230866)
    - CVE-2024-44070: crash when parsing Tunnel Encap attribute due to no length check. (bsc#1229438)
    - CVE-2022-37032: out-of-bounds read when parsing a BGP capability message due to incorrect size check.
    (bsc#1202023)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3433-1 advisory.

    - CVE-2017-15865: sensitive information disclosed when malformed BGP UPDATE packets are processed.
    (bsc#1230866)
    - CVE-2024-44070: crash when parsing Tunnel Encap attribute due to no length check. (bsc#1229438)
    - CVE-2022-37032: out-of-bounds read when parsing a BGP capability message due to incorrect size check.
    (bsc#1202023)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3426-1 advisory.

    - CVE-2017-15865: sensitive information disclosed when malformed BGP UPDATE packets are processed.
    (bsc#1230866)
    - CVE-2024-44070: crash when parsing Tunnel Encap attribute due to no length check. (bsc#1229438)
    - CVE-2022-37032: out-of-bounds read when parsing a BGP capability message due to incorrect size check.
    (bsc#1202023)

    Bug fixes:
    - References to /var/adm/fillup-templates replaced with new %_fillupdir macro. (bsc#1069468)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

FRR reports :

BGP Mishandled attribute length on Error

A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE packet can leak information from the BGP daemon and cause a denial of service by crashing the daemon.

ID	Name	Product	Family	Severity
208213	SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2024:3524-1)	Nessus	SuSE Local Security Checks	high
207885	SUSE SLES15: libfpm_pb0 / libospf0 / libospfapiclient0 / libquagga_pb0 / etc (SUSE-SU-2024:3478-1)	Nessus	SuSE Local Security Checks	critical
207784	SUSE SLES15: libfpm_pb0 / libospf0 / libospfapiclient0 / libquagga_pb0 / etc (SUSE-SU-2024:3433-1)	Nessus	SuSE Local Security Checks	critical
207715	SUSE SLES12: libfpm_pb0 / libospf0 / libospfapiclient0 / libquagga_pb0 / etc (SUSE-SU-2024:3426-1)	Nessus	SuSE Local Security Checks	critical
104732	FreeBSD : frr -- BGP Mishandled attribute length on Error (bf266183-cec7-11e7-af2d-2047478f2f70)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-15865

high

Tenable Plugins

high

critical

critical

critical

high