Read the docs
TI-2017-03515 Aliases CVE-2017-5495GHSA-6629-rcxv-r9v7

All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory…

Priority MEDIUM 51CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.

Why it matters now

EPSS 0.18803 97th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:*up to 1.1.0VulnerableQuagga
  • cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·Quagga

Remediation

Red Hat 1 advisory

  • RHSA-2017:0794 Released 2017-03-21 · Red Hat rating Moderate
    quagga security and bug fix update
    • Red Hat Enterprise Linux Server (v. 6) quagga-0.99.15-14.el6
    • Red Hat Enterprise Linux Server Optional (v. 6) quagga-contrib-0.99.15-14.el6, quagga-devel-0.99.15-14.el6, quagga-devel-0.99.15-14.el6.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) quagga-0.99.15-14.el6
    • Red Hat Enterprise Linux Workstation Optional (v. 6) quagga-contrib-0.99.15-14.el6, quagga-devel-0.99.15-14.el6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:0794
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2017:0794
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:0794
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2017:0794

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5495
  2. 2026-10-03 Alias added: GHSA-6629-rcxv-r9v7

References

Patch 1

Advisory 2

Other 1

  • TI-2018-03911 Memory corruption in Quagga bgpd CVSS 3.0HIGH 7.1
  • TI-2018-03912 Double free in Quagga bgpd CVSS 3.0CRITICAL 9.8
  • TI-2017-11946 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote… CVSS 3.0HIGH 7.5
  • TI-2018-03914 Infinite loop in Quagga bgpd CVSS 3.0HIGH 7.5
  • TI-2016-02105 The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in… CVSS 3.0HIGH 8.1
  • TI-2016-01143 Memory corruption in Quagga before 1.0.20161017 CVSS 3.0CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences