CVE-2012-1820
(bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV (VU#962587)
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.
La función bgp_capability_orf de bgpd de Quagga 0.99.20.1 y anteriores permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y finalización del demonio) basándose en una relación "BGP peering" y enviando información mal formada de "Outbound Route Filtering (ORF) capability TLV" en un mensaje OPEN.
Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP routing protocol. The Quagga ospfd and ospf6d daemons implement the OSPF routing protocol. A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially-crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-03-21 CVE Reserved
- 2012-06-13 CVE Published
- 2024-08-06 CVE Updated
- 2025-12-01 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/50941 | Third Party Advisory | |
| http://www.kb.cert.org/vuls/id/962587 | Third Party Advisory |
|
| http://www.securityfocus.com/bid/53775 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2012-1259.html | 2013-03-02 | |
| http://www.debian.org/security/2012/dsa-2497 | 2013-03-02 | |
| http://www.ubuntu.com/usn/USN-1605-1 | 2013-03-02 | |
| https://access.redhat.com/security/cve/CVE-2012-1820 | 2012-09-12 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=817580 | 2012-09-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | <= 0.99.20.1 Search vendor "Quagga" for product "Quagga" and version " <= 0.99.20.1" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.95 Search vendor "Quagga" for product "Quagga" and version "0.95" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96 Search vendor "Quagga" for product "Quagga" and version "0.96" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96.1 Search vendor "Quagga" for product "Quagga" and version "0.96.1" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96.2 Search vendor "Quagga" for product "Quagga" and version "0.96.2" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96.3 Search vendor "Quagga" for product "Quagga" and version "0.96.3" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96.4 Search vendor "Quagga" for product "Quagga" and version "0.96.4" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.96.5 Search vendor "Quagga" for product "Quagga" and version "0.96.5" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.0 Search vendor "Quagga" for product "Quagga" and version "0.97.0" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.1 Search vendor "Quagga" for product "Quagga" and version "0.97.1" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.2 Search vendor "Quagga" for product "Quagga" and version "0.97.2" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.3 Search vendor "Quagga" for product "Quagga" and version "0.97.3" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.4 Search vendor "Quagga" for product "Quagga" and version "0.97.4" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.97.5 Search vendor "Quagga" for product "Quagga" and version "0.97.5" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.0 Search vendor "Quagga" for product "Quagga" and version "0.98.0" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.1 Search vendor "Quagga" for product "Quagga" and version "0.98.1" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.2 Search vendor "Quagga" for product "Quagga" and version "0.98.2" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.3 Search vendor "Quagga" for product "Quagga" and version "0.98.3" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.4 Search vendor "Quagga" for product "Quagga" and version "0.98.4" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.5 Search vendor "Quagga" for product "Quagga" and version "0.98.5" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.98.6 Search vendor "Quagga" for product "Quagga" and version "0.98.6" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.1 Search vendor "Quagga" for product "Quagga" and version "0.99.1" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.2 Search vendor "Quagga" for product "Quagga" and version "0.99.2" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.3 Search vendor "Quagga" for product "Quagga" and version "0.99.3" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.4 Search vendor "Quagga" for product "Quagga" and version "0.99.4" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.5 Search vendor "Quagga" for product "Quagga" and version "0.99.5" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.6 Search vendor "Quagga" for product "Quagga" and version "0.99.6" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.7 Search vendor "Quagga" for product "Quagga" and version "0.99.7" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.8 Search vendor "Quagga" for product "Quagga" and version "0.99.8" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.9 Search vendor "Quagga" for product "Quagga" and version "0.99.9" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.10 Search vendor "Quagga" for product "Quagga" and version "0.99.10" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.11 Search vendor "Quagga" for product "Quagga" and version "0.99.11" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.12 Search vendor "Quagga" for product "Quagga" and version "0.99.12" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.13 Search vendor "Quagga" for product "Quagga" and version "0.99.13" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.14 Search vendor "Quagga" for product "Quagga" and version "0.99.14" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.15 Search vendor "Quagga" for product "Quagga" and version "0.99.15" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.16 Search vendor "Quagga" for product "Quagga" and version "0.99.16" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.17 Search vendor "Quagga" for product "Quagga" and version "0.99.17" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.18 Search vendor "Quagga" for product "Quagga" and version "0.99.18" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.19 Search vendor "Quagga" for product "Quagga" and version "0.99.19" | - |
Affected
| ||||||
| Quagga Search vendor "Quagga" | Quagga Search vendor "Quagga" for product "Quagga" | 0.99.20 Search vendor "Quagga" for product "Quagga" and version "0.99.20" | - |
Affected
| ||||||