proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-14 14:17:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2,766 Commits 4 Branches 191 Tags 125 MiB
C 71.4%
Python 26.5%
Perl 0.6%
M4 0.6%
Shell 0.3%
Other 0.4%
fe9bb6459a
Go to file
Denis Ovsienko fe9bb6459a bgpd: CVE-2012-1820, DoS in bgp_capability_orf() 
An ORF (code 3) capability TLV is defined to contain exactly one
AFI/SAFI block. Function bgp_capability_orf(), which parses ORF
capability TLV, uses do-while cycle to call its helper function
bgp_capability_orf_entry(), which actually processes the AFI/SAFI data
block. The call is made at least once and repeated as long as the input
buffer has enough data for the next call.

The helper function, bgp_capability_orf_entry(), uses "Number of ORFs"
field of the provided AFI/SAFI block to verify, if it fits the input
buffer. However, the check is made based on the total length of the ORF
TLV regardless of the data already consumed by the previous helper
function call(s). This way, the check condition is only valid for the
first AFI/SAFI block inside an ORF capability TLV.

For the subsequent calls of the helper function, if any are made, the
check condition may erroneously tell, that the current "Number of ORFs"
field fits the buffer boundary, where in fact it does not. This makes it
possible to trigger an assertion by feeding an OPEN message with a
specially-crafted malformed ORF capability TLV.

This commit fixes the vulnerability by making the implementation follow
the spec.
2012-11-01 23:07:15 -07:00
babeld *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
bgpd bgpd: CVE-2012-1820, DoS in bgp_capability_orf() 2012-11-01 23:07:15 -07:00
doc agentx: add appropriate documentation 2012-06-25 19:03:23 +02:00
guile build: allow configure and build in a separate directory 2012-06-25 19:03:23 +02:00
init build: delete .cvsignore files 2011-12-13 14:27:01 +04:00
isisd *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
lib lib: treat OSX as BSD for IP_HDRINCL (BZ#739) 2012-11-01 22:58:36 -07:00
m4 build: delete .cvsignore files 2011-12-13 14:27:01 +04:00
ospf6d *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
ospfclient build: correct libtool parameter used within Makefiles 2012-09-25 05:56:00 +02:00
ospfd *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
pkgsrc build: delete .cvsignore files 2011-12-13 14:27:01 +04:00
ports build: delete .cvsignore files 2011-12-13 14:27:01 +04:00
redhat redhat: add systemd service files 2012-05-01 17:51:26 +02:00
ripd *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
ripngd *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
solaris build: delete .cvsignore files 2011-12-13 14:27:01 +04:00
tests build: reorder libraries to address linker error 2012-11-01 23:03:24 -07:00
tools tools: use standard interpreter path in all Perl scripts 2012-04-30 16:13:47 +02:00
vtysh *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
watchquagga *: use array_size() helper macro 2012-10-25 10:15:59 -07:00
zebra build: reorder libraries to address linker error 2012-11-01 23:03:24 -07:00
.gitignore build: ignore mkinstalldirs and texinfo.tex 2010-04-28 20:57:44 -04:00
AUTHORS Initial revision 2002-12-13 20:15:29 +00:00
bootstrap.sh autoreconf -i 2007-02-06 19:28:28 +00:00
ChangeLog [trivia] Make 'make dist' happy about ChangeLog expunge 2008-08-23 08:36:42 +01:00
configure.ac build: fix autoconf multicast check on OpenBSD 2012-09-25 05:56:04 +02:00
COPYING Initial revision 2002-12-13 20:15:29 +00:00
COPYING.LIB Initial revision 2002-12-13 20:15:29 +00:00
HACKING.pending HACKING.pending: Add Quagga-RE details 2012-03-02 11:56:38 +00:00
HACKING.tex HACKING.tex: Change to a LaTeX version of HACKING 2012-03-08 16:14:13 +00:00
INSTALL.quagga.txt delete CVS keywords 2011-09-27 21:34:26 +04:00
Makefile.am babeld: Initial import, for Babel routing protocol. 2012-03-25 17:06:51 +01:00
NEWS release: 0.99.21 2012-05-01 21:43:53 +02:00
README 2004-11-12 Paul Jakma <paul@dishone.st> 2004-11-12 10:30:21 +00:00
README.NetBSD Omit --opaque-lsa from build (now default). 2011-06-28 15:05:05 -04:00
REPORTING-BUGS Update for git and emphasize asking for good reports. 2010-05-05 07:51:26 -04:00
SERVICES 2607/tcp is already used by ospfapi. 2003-12-23 10:42:45 +00:00
stamp-h.in Initial revision 2002-12-13 20:15:29 +00:00
TODO [TODO] Note MED functionality we should implement 2006-03-30 14:36:23 +00:00
update-autotools * README.NetBSD: use update-autotools instead of autoreconf 2007-02-02 16:52:38 +00:00

README 

Quagga is free software that manages various IPv4 and IPv6 routing
protocols.

Currently Quagga supports BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1,
RIPv2, and RIPng as well as very early support for IS-IS.
  
See the file INSTALL.quagga.txt for building and installation instructions.
  
See the file REPORTING-BUGS to report bugs.
  
Quagga is free software. See the file COPYING for copying conditions.