| Package | Affected versions | Patched versions |
|---|---|---|
| zebra | = 0.91a= 0.92a= 0.93a= 0.93b | |
| quagga | = 0.95= 0.96= 0.96.1= 0.96.2≤ 0.96.3 | |
| propack | = 2.2.1= 2.3 |
The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free