CVE-2009-1572

The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311Exploit, Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
• http://marc.info/?l=quagga-dev&m=123364779626078&w=2Exploit, Patch
• http://secunia.com/advisories/34999Vendor Advisory
• http://secunia.com/advisories/35061Vendor Advisory
• http://secunia.com/advisories/35203Vendor Advisory
• http://secunia.com/advisories/35685Vendor Advisory
• http://thread.gmane.org/gmane.network.quagga.devel/6513Exploit
• http://www.debian.org/security/2009/dsa-1788Patch
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:109
• http://www.openwall.com/lists/oss-security/2009/05/01/1
• http://www.openwall.com/lists/oss-security/2009/05/01/2
• http://www.osvdb.org/54200
• http://www.securityfocus.com/bid/34817
• http://www.securitytracker.com/id?1022164
• http://www.ubuntu.com/usn/usn-775-1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50317
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01037.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01107.html
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526311Exploit, Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
• http://marc.info/?l=quagga-dev&m=123364779626078&w=2Exploit, Patch
• http://secunia.com/advisories/34999Vendor Advisory
• http://secunia.com/advisories/35061Vendor Advisory
• http://secunia.com/advisories/35203Vendor Advisory
• http://secunia.com/advisories/35685Vendor Advisory
• http://thread.gmane.org/gmane.network.quagga.devel/6513Exploit
• http://www.debian.org/security/2009/dsa-1788Patch
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:109
• http://www.openwall.com/lists/oss-security/2009/05/01/1
• http://www.openwall.com/lists/oss-security/2009/05/01/2
• http://www.osvdb.org/54200
• http://www.securityfocus.com/bid/34817
• http://www.securitytracker.com/id?1022164
• http://www.ubuntu.com/usn/usn-775-1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50317
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01037.html
• https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01107.html

Published

May 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1566Integer overflow in Roxio Easy Media Creator 9.0.136, and Ro…
• CVE-2009-1567Multiple stack-based buffer overflows in the Lateral Arts Ph…
• CVE-2009-1568Stack-based buffer overflow in ienipp.ocx in Novell iPrint C…
• CVE-2009-1569Multiple stack-based buffer overflows in Novell iPrint Clien…
• CVE-2009-1570Integer overflow in the ReadImage function in plug-ins/file-…
• CVE-2009-1571Use-after-free vulnerability in the HTML parser in Mozilla F…
• CVE-2009-1573xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and p…
• CVE-2009-1574racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remo…
• CVE-2009-1575Cross-site scripting (XSS) vulnerability in Drupal 5.x befor…
• CVE-2009-1576Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x …
• CVE-2009-1577Multiple stack-based buffer overflows in the putstring funct…
• CVE-2009-1578Multiple cross-site scripting (XSS) vulnerabilities in Squir…