bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0086 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-38406:
    bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow.

    CVE-2023-38407:
    bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing.

    CVE-2023-47234:
    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes).

    CVE-2023-47235:
    An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4090-1 advisory.

    Update to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:

    - CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,       CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,       CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,       CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,       CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.
      See https://frrouting.org/release/8.5.6/ for details.

    The most recent frr 8.x series provides several new features,     improvements and bug fixes for various protocols and daemons,     especially for PIM/PIMv6/BGP and VRF support.

    See https://frrouting.org/release/8.5/ for details and links.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3865 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3865-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     September 03, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : frr     Version        : 7.5.1-1.1+deb11u3     CVE ID         : CVE-2022-26125 CVE-2022-26126 CVE-2022-26127 CVE-2022-26128                      CVE-2022-26129 CVE-2022-37035 CVE-2023-38406 CVE-2023-38407                      CVE-2023-46752 CVE-2023-46753 CVE-2023-47234 CVE-2023-47235                      CVE-2024-31948 CVE-2024-31949 CVE-2024-44070     Debian Bug     : 1008010 1016978 1055852 1079649

    Several vulnerabilities have been found in frr, the FRRouting suite of     internet protocols. An attacker could craft packages to potentially trigger     those effects: buffer overflows with the possibility to gain remote code     execution, buffer overreads, crashes or trick the software to enter an     infinite loop.

    CVE-2022-26125

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         wrong checks on the input packet length in isisd/isis_tlvs.c.

    CVE-2022-26126

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         the use of strdup with a non-zero-terminated binary string in         isis_nb_notifications.c.

    CVE-2022-26127

        A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to         missing a check on the input packet length in the babel_packet_examin         function in babeld/message.c.

    CVE-2022-26128

        A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to         a wrong check on the input packet length in the babel_packet_examin         function in babeld/message.c.

    CVE-2022-26129

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         wrong checks on the subtlv length in the functions, parse_hello_subtlv,         parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

    CVE-2022-37035

        An issue was discovered in bgpd in FRRouting (FRR) 8.3. In         bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c,         there is a possible use-after-free due to a race condition. This could         lead to Remote Code Execution or Information Disclosure by sending         crafted BGP packets. User interaction is not needed for exploitation.

    CVE-2023-38406

        bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri         length of zero, aka a flowspec overflow.

    CVE-2023-38407

        bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond         the end of the stream during labeled unicast parsing.

    CVE-2023-46752

        An issue was discovered in FRRouting FRR through 9.0.1. It mishandles         malformed MP_REACH_NLRI data, leading to a crash.

    CVE-2023-46753

        An issue was discovered in FRRouting FRR through 9.0.1. A crash can         occur for a crafted BGP UPDATE message without mandatory attributes,         e.g., one with only an unknown transit attribute.

    CVE-2023-47234

        An issue was discovered in bgpd in FRRouting (FRR) 8.3. In         bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c,         there is a possible use-after-free due to a race condition. This could         lead to Remote Code Execution or Information Disclosure by sending         crafted BGP packets. User interaction is not needed for exploitation.

    CVE-2023-47235

        An issue was discovered in FRRouting FRR through 9.0.1. A crash can         occur when a malformed BGP UPDATE message with an EOR is processed,         because the presence of EOR does not lead to a treat-as-withdraw         outcome.

    CVE-2024-31948

        In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID         attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.

    CVE-2024-31949

        In FRRouting (FRR) through 9.1, an infinite loop can occur when         receiving a MP/GR capability as a dynamic capability because malformed         data results in a pointer not advancing.

    CVE-2024-44070

        An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap         in bgpd/bgp_attr.c does not check the actual remaining stream length         before taking the TLV value.

    For Debian 11 bullseye, these problems have been fixed in version     7.5.1-1.1+deb11u3.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2245-1 advisory.

    - CVE-2023-38406: Fixed nlri length of zero mishandling, aka 'flowspec overflow'. (bsc#1216900)
    - CVE-2023-47235: Fixed a crash on malformed BGP UPDATE message with an EOR, because the presence of EOR     does not lead to a treat-as-withdraw outcome. (bsc#1216896)
    - CVE-2023-47234: Fixed a crash on crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and     additional NLRI data. (bsc#1216897)
    - CVE-2023-38407: Fixed attempts to read beyond the end of the stream during labeled unicast parsing.
    (bsc#1216899)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6807-1 advisory.

    It was discovered that FRR incorrectly handled certain network traffic. A remote attacker could possibly     use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2022-26126, CVE-2022-26127,     CVE-2022-26128, CVE-2022-26129, CVE-2022-37032, CVE-2022-37035, CVE-2023-31490, CVE-2023-38406,     CVE-2023-38407, CVE-2023-46752, CVE-2023-46753, CVE-2023-47234, CVE-2023-47235, CVE-2024-31948)

    Ben Cartwright-Cox discovered that FRR incorrectly handled certain network traffic. A remote attacker     could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2023-38802)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3797 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3797-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     April 28, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : frr     Version        : 7.5.1-1.1+deb10u2     CVE ID         : CVE-2022-26125 CVE-2022-26126 CVE-2022-26127 CVE-2022-26128                      CVE-2022-26129 CVE-2022-37035 CVE-2023-38406 CVE-2023-38407                      CVE-2023-46752 CVE-2023-46753 CVE-2023-47234 CVE-2023-47235                      CVE-2024-31948 CVE-2024-31949     Debian Bug     : 1008010 1016978 1055852

    Several vulnerabilities have been found in frr, the FRRouting suite of     internet protocols. An attacker could craft packages to trigger buffer     overflows with the possibility to gain remote code execution, buffer     overreads, crashes or trick the software to enter an infinite loop.

    CVE-2022-26125

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         wrong checks on the input packet length in isisd/isis_tlvs.c.

    CVE-2022-26126

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         the use of strdup with a non-zero-terminated binary string in         isis_nb_notifications.c.

    CVE-2022-26127

        A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to         missing a check on the input packet length in the babel_packet_examin         function in babeld/message.c.

    CVE-2022-26128

        A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to         a wrong check on the input packet length in the babel_packet_examin         function in babeld/message.c.

    CVE-2022-26129

        Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to         wrong checks on the subtlv length in the functions, parse_hello_subtlv,         parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

    CVE-2022-37035

        An issue was discovered in bgpd in FRRouting (FRR) 8.3. In         bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c,         there is a possible use-after-free due to a race condition. This could         lead to Remote Code Execution or Information Disclosure by sending         crafted BGP packets. User interaction is not needed for exploitation.

    CVE-2023-38406

        bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri         length of zero, aka a flowspec overflow.

    CVE-2023-38407

        bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond         the end of the stream during labeled unicast parsing.

    CVE-2023-46752

        An issue was discovered in FRRouting FRR through 9.0.1. It mishandles         malformed MP_REACH_NLRI data, leading to a crash.

    CVE-2023-46753

        An issue was discovered in FRRouting FRR through 9.0.1. A crash can         occur for a crafted BGP UPDATE message without mandatory attributes,         e.g., one with only an unknown transit attribute.

    CVE-2023-47234

        An issue was discovered in bgpd in FRRouting (FRR) 8.3. In         bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c,         there is a possible use-after-free due to a race condition. This could         lead to Remote Code Execution or Information Disclosure by sending         crafted BGP packets. User interaction is not needed for exploitation.

    CVE-2023-47235

        An issue was discovered in FRRouting FRR through 9.0.1. A crash can         occur when a malformed BGP UPDATE message with an EOR is processed,         because the presence of EOR does not lead to a treat-as-withdraw         outcome.

    CVE-2024-31948

        In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID         attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.

    CVE-2024-31949

        In FRRouting (FRR) through 9.1, an infinite loop can occur when         receiving a MP/GR capability as a dynamic capability because malformed         data results in a pointer not advancing.

    For Debian 10 buster, these problems have been fixed in version     7.5.1-1.1+deb10u2.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1113 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    Bug Fix(es):

    * Zebra not fetching host routes (RHEL-24695)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1152 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1093 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0574 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0477 advisory.

    [8.3.1-11.2]
    - Add patches for CVE-2023-47235, CVE-2023-47234, CVE-2023-38406, CVE-2023-38407

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0477 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0477 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0130 advisory.

    [7.5.1-13.3]
    - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c
    - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c
    - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
    - Resolves: RHEL-15868 - crash from malformed EOR-containing BGP UPDATE message

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0130 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0130 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0130 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4663-1 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6498-1 advisory.

    It was discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use     this issue to cause FRR to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
235947	Alibaba Cloud Linux 3 : 0086: frr (ALINUX3-SA-2024:0086)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
226423	Linux Distros Unpatched Vulnerability : CVE-2023-38407	Nessus	Misc.	high
212585	SUSE SLES15 / openSUSE 15 Security Update : frr (SUSE-SU-2024:4090-1)	Nessus	SuSE Local Security Checks	critical
206448	Debian dla-3865 : frr - security update	Nessus	Debian Local Security Checks	critical
201157	SUSE SLES15 Security Update : frr (SUSE-SU-2024:2245-1)	Nessus	SuSE Local Security Checks	critical
200127	Ubuntu 20.04 LTS : FRR vulnerabilities (USN-6807-1)	Nessus	Ubuntu Local Security Checks	critical
194417	Debian dla-3797 : frr - security update	Nessus	Debian Local Security Checks	critical
191586	RHEL 8 : frr (RHSA-2024:1113)	Nessus	Red Hat Local Security Checks	critical
191585	RHEL 9 : frr (RHSA-2024:1152)	Nessus	Red Hat Local Security Checks	critical
191545	RHEL 9 : frr (RHSA-2024:1093)	Nessus	Red Hat Local Security Checks	critical
189811	RHEL 8 : frr (RHSA-2024:0574)	Nessus	Red Hat Local Security Checks	critical
189628	Oracle Linux 9 : frr (ELSA-2024-0477)	Nessus	Oracle Linux Local Security Checks	critical
189626	AlmaLinux 9 : frr (ALSA-2024:0477)	Nessus	Alma Linux Local Security Checks	critical
189576	RHEL 9 : frr (RHSA-2024:0477)	Nessus	Red Hat Local Security Checks	critical
188026	Oracle Linux 8 : frr (ELSA-2024-0130)	Nessus	Oracle Linux Local Security Checks	critical
188022	Rocky Linux 8 : frr (RLSA-2024:0130)	Nessus	Rocky Linux Local Security Checks	critical
187892	RHEL 8 : frr (RHSA-2024:0130)	Nessus	Red Hat Local Security Checks	critical
187868	CentOS 8 : frr (CESA-2024:0130)	Nessus	CentOS Local Security Checks	critical
186641	SUSE SLES15 / openSUSE 15 Security Update : frr (SUSE-SU-2023:4663-1)	Nessus	SuSE Local Security Checks	critical
186086	Ubuntu 22.04 LTS / 23.04 / 23.10 : FRR vulnerabilities (USN-6498-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-38407

high

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical