CVE-2007-1995

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

• CWE-20

• http://bugzilla.quagga.net/show_bug.cgi?id=354
• http://bugzilla.quagga.net/show_bug.cgi?id=355
• http://secunia.com/advisories/24808Vendor Advisory
• http://secunia.com/advisories/25084Vendor Advisory
• http://secunia.com/advisories/25119Vendor Advisory
• http://secunia.com/advisories/25255Vendor Advisory
• http://secunia.com/advisories/25293Vendor Advisory
• http://secunia.com/advisories/25312Vendor Advisory
• http://secunia.com/advisories/25428Vendor Advisory
• http://secunia.com/advisories/29743Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-05.xml
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-236141-1
• http://www.debian.org/security/2007/dsa-1293
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:096
• http://www.novell.com/linux/security/advisories/2007_9_sr.html
• http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.015.html
• http://www.quagga.net/news2.php?y=2007&m=4&d=8#id1176073740
• http://www.redhat.com/support/errata/RHSA-2007-0389.html
• http://www.securityfocus.com/bid/23417
• http://www.securitytracker.com/id?1018142
• http://www.trustix.org/errata/2007/0017/
• http://www.ubuntu.com/usn/usn-461-1
• http://www.vupen.com/english/advisories/2007/1336Vendor Advisory
• http://www.vupen.com/english/advisories/2008/1195/referencesVendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33547
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11048
• http://bugzilla.quagga.net/show_bug.cgi?id=354
• http://bugzilla.quagga.net/show_bug.cgi?id=355
• http://secunia.com/advisories/24808Vendor Advisory
• http://secunia.com/advisories/25084Vendor Advisory
• http://secunia.com/advisories/25119Vendor Advisory
• http://secunia.com/advisories/25255Vendor Advisory
• http://secunia.com/advisories/25293Vendor Advisory
• http://secunia.com/advisories/25312Vendor Advisory
• http://secunia.com/advisories/25428Vendor Advisory
• http://secunia.com/advisories/29743Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-05.xml
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-236141-1
• http://www.debian.org/security/2007/dsa-1293
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:096
• http://www.novell.com/linux/security/advisories/2007_9_sr.html
• http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.015.html
• http://www.quagga.net/news2.php?y=2007&m=4&d=8#id1176073740
• http://www.redhat.com/support/errata/RHSA-2007-0389.html
• http://www.securityfocus.com/bid/23417
• http://www.securitytracker.com/id?1018142
• http://www.trustix.org/errata/2007/0017/
• http://www.ubuntu.com/usn/usn-461-1
• http://www.vupen.com/english/advisories/2007/1336Vendor Advisory
• http://www.vupen.com/english/advisories/2008/1195/referencesVendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33547
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11048

Published

Apr 12, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1989Multiple cross-site scripting (XSS) vulnerabilities in DotCl…
• CVE-2007-1990PHP remote file inclusion vulnerability in games.php in Sam …
• CVE-2007-1991Cross-site scripting (XSS) vulnerability in mail/signup.asp …
• CVE-2007-1992Multiple PHP remote file inclusion vulnerabilities in the co…
• CVE-2007-1993Buffer overflow in the pfs_mountd.rpc RPC daemon in the Port…
• CVE-2007-1994Unspecified vulnerability in the Address and Routing Paramet…
• CVE-2007-1996PHP remote file inclusion vulnerability in codebreak.php in …
• CVE-2007-1997Integer signedness error in the (1) cab_unstore and (2) cab_…
• CVE-2007-1998Direct static code injection vulnerability in HIOX Guest Boo…
• CVE-2007-1999PHP remote file inclusion vulnerability in index.php in Weat…
• CVE-2007-2000Multiple SQL injection vulnerabilities in admin/admin.php in…
• CVE-2007-20001A flaw was found in StarWind iSCSI target. An attacker could…7.5