CVE-2016-2342

Name of the Vulnerable Software and Affected Versions Quagga versions prior to 1.0.20160309

Description The issue arises from the bgp nlri parse vpnv4 function in bgp mplsvpn.c within the VPNv4 NLRI parser in bgpd when a specific VPNv4 configuration is used. It relies on a Labeled-VPN SAFI routes-data length field during a data copy, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted packet, resulting in a stack-based buffer overflow.

Recommendations For versions prior to 1.0.20160309, update to version 1.0.20160309 or later to resolve the issue. As a temporary workaround, consider restricting the use of the VPNv4 configuration that triggers this issue until a patch is applied.