The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2156 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)

    * frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)

    * frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)

    * frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)

    * frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)

    * frr: mishandled malformed data leading to a crash (CVE-2023-46752)

    * frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)

    * frr: ahead-of-stream read of ORF header (CVE-2023-41360)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce436d56f8 advisory.

  - FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of     service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). (CVE-2023-38802)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation. (CVE-2023-41359)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the     ORF header in an ahead-of-stream situation. (CVE-2023-41360)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_capability_llgr() function. (CVE-2023-31489)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2156 advisory.

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute. (CVE-2023-46753)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_capability_llgr() function. (CVE-2023-31489)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the     ORF header in an ahead-of-stream situation. (CVE-2023-41360)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

  - An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation. (CVE-2023-41359)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash. (CVE-2023-46752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of frr installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-41359 advisory.

  - An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation. (CVE-2023-41359)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-514db5339e advisory.

  - FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of     service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). (CVE-2023-38802)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation. (CVE-2023-41359)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the     ORF header in an ahead-of-stream situation. (CVE-2023-41360)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_capability_llgr() function. (CVE-2023-31489)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-61abba57d8 advisory.

  - FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of     service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). (CVE-2023-38802)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in     bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during     AIGP validation. (CVE-2023-41359)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the     ORF header in an ahead-of-stream situation. (CVE-2023-41360)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_capability_llgr() function. (CVE-2023-31489)

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
194782	RHEL 9 : frr (RHSA-2024:2156)	Nessus	Red Hat Local Security Checks	4/30/2024	6/3/2024	critical
185610	Fedora 37 : frr (2023-ce436d56f8)	Nessus	Fedora Local Security Checks	11/14/2023	11/14/2023	critical
195033	Oracle Linux 9 : frr (ELSA-2024-2156)	Nessus	Oracle Linux Local Security Checks	5/6/2024	5/6/2024	critical
182147	CBL Mariner 2.0 Security Update: frr (CVE-2023-41359)	Nessus	MarinerOS Local Security Checks	9/28/2023	9/28/2023	critical
185611	Fedora 39 : frr (2023-514db5339e)	Nessus	Fedora Local Security Checks	11/14/2023	11/14/2023	critical
185613	Fedora 38 : frr (2023-61abba57d8)	Nessus	Fedora Local Security Checks	11/14/2023	11/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical