An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6807-1 advisory.

    It was discovered that FRR incorrectly handled certain network traffic. A remote attacker could possibly     use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2022-26126, CVE-2022-26127,     CVE-2022-26128, CVE-2022-26129, CVE-2022-37032, CVE-2022-37035, CVE-2023-31490, CVE-2023-38406,     CVE-2023-38407, CVE-2023-46752, CVE-2023-46753, CVE-2023-47234, CVE-2023-47235, CVE-2024-31948)

    Ben Cartwright-Cox discovered that FRR incorrectly handled certain network traffic. A remote attacker     could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2023-38802)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3797 advisory.

  - Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet     length in isisd/isis_tlvs.c. (CVE-2022-26125)

  - Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-     terminated binary string in isis_nb_notifications.c. (CVE-2022-26126)

  - A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input     packet length in the babel_packet_examin function in babeld/message.c. (CVE-2022-26127)

  - A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet     length in the babel_packet_examin function in babeld/message.c. (CVE-2022-26128)

  - Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length     in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.
    (CVE-2022-26129)

  - An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and     bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This     could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User     interaction is not needed for exploitation. (CVE-2022-37035)

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash. (CVE-2023-46752)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute. (CVE-2023-46753)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

  - In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet     can cause the bgpd daemon to crash. (CVE-2024-31948)

  - In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic     capability because malformed data results in a pointer not advancing. (CVE-2024-31949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1113 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    Bug Fix(es):

    * Zebra not fetching host routes (RHEL-24695)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1152 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1093 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0574 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0477 advisory.

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0477 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0477 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0130 advisory.

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0130 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0130 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0130 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4663-1 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6498-1 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200127	Ubuntu 20.04 LTS : FRR vulnerabilities (USN-6807-1)	Nessus	Ubuntu Local Security Checks	critical
194417	Debian dla-3797 : frr - security update	Nessus	Debian Local Security Checks	critical
191586	RHEL 8 : frr (RHSA-2024:1113)	Nessus	Red Hat Local Security Checks	critical
191585	RHEL 9 : frr (RHSA-2024:1152)	Nessus	Red Hat Local Security Checks	critical
191545	RHEL 9 : frr (RHSA-2024:1093)	Nessus	Red Hat Local Security Checks	critical
189811	RHEL 8 : frr (RHSA-2024:0574)	Nessus	Red Hat Local Security Checks	critical
189628	Oracle Linux 9 : frr (ELSA-2024-0477)	Nessus	Oracle Linux Local Security Checks	critical
189626	AlmaLinux 9 : frr (ALSA-2024:0477)	Nessus	Alma Linux Local Security Checks	critical
189576	RHEL 9 : frr (RHSA-2024:0477)	Nessus	Red Hat Local Security Checks	critical
188026	Oracle Linux 8 : frr (ELSA-2024-0130)	Nessus	Oracle Linux Local Security Checks	critical
188022	Rocky Linux 8 : frr (RLSA-2024:0130)	Nessus	Rocky Linux Local Security Checks	critical
187892	RHEL 8 : frr (RHSA-2024:0130)	Nessus	Red Hat Local Security Checks	critical
187868	CentOS 8 : frr (CESA-2024:0130)	Nessus	CentOS Local Security Checks	critical
186641	SUSE SLES15 / openSUSE 15 Security Update : frr (SUSE-SU-2023:4663-1)	Nessus	SuSE Local Security Checks	critical
186086	Ubuntu 22.04 LTS / 23.04 / 23.10 : FRR vulnerabilities (USN-6498-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-47235

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical