SB2024060326 - Ubuntu update for frr
Published: June 3, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2024-31950)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ospf_te_parse_ri when parsing OSPF LSA packets. A remote attacker can send specially crafted packets to the system, trigger memory corruption and perform a denial of service (DoS) attack.
2) Buffer overflow (CVE-ID: CVE-2024-31948)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when parsing Prefix SID attribute in a BGP UPDATE packet. A remote attacker can send specially crafted packets to the application, trigger memory corruption and crash the bgpd daemon.
3) NULL pointer dereference (CVE-ID: CVE-2024-34088)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the get_edge() function in ospf_te.c. A remote attacker can send specially crafted packets to the daemon and perform a denial of service (DoS) attack.
4) Buffer overflow (CVE-ID: CVE-2024-31951)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in ospf_te_parse_ext_link when parsing OSPF LSA packets. A remote attacker can send specially crafted packets to the daemon, trigger memory corruption and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.