BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.

BIRD 2.0.6 (2019-09-10) =======================

  - RAdv: Solicited unicast RAs

  - BGP: Optional Adj-RIB-Out

  - BGP: Extended optional parameters length

  - Filter: Sets and set expressions in path masks

  - Several important bugfixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bird fixes the following issues :

  - CVE-2019-16159: Fixed a stack-based buffer overflow via     administrative shutdown communication messages.
    (bnc#1150108)

BIRD 1.6.8 (2019-09-10) =======================

  - Several important bugfixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel McCarney discovered that the BIRD internet routing daemon incorrectly validated RFC 8203 messages in it's BGP daemon, resulting in a stack-based buffer overflow.

ID	Name	Product	Family	Severity
129660	Fedora 31 : bird (2019-ff0f9ce167)	Nessus	Fedora Local Security Checks	high
129344	openSUSE Security Update : bird (openSUSE-2019-2178)	Nessus	SuSE Local Security Checks	high
129083	Fedora 29 : bird (2019-b629e3b97f)	Nessus	Fedora Local Security Checks	high
129082	Fedora 30 : bird (2019-ace80f492e)	Nessus	Fedora Local Security Checks	high
129074	Debian DSA-4528-1 : bird - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-16159

high

Tenable Plugins

high

high

high

high

high