diff options
| author | Quentin Young <qlyoung@cumulusnetworks.com> | 2017-10-23 16:43:32 -0400 |
|---|---|---|
| committer | Quentin Young <qlyoung@cumulusnetworks.com> | 2017-11-06 18:38:05 -0500 |
| commit | dacffad46143fb57e5fa973fcbfbd0eb51ea37b2 (patch) | |
| tree | 9eaabf1bf0ee69b951a3d46a43b3f080ad898565 /doc/code/conf.py | |
| parent | 11567ce5a05eb4e520eff576e8269741dc64edc4 (diff) | |
bgpd: fix mishandled attribute length
A crafted BGP UPDATE with a malformed path attribute length field causes
bgpd to dump up to 65535 bytes of application memory and send it as the
data field in a BGP NOTIFY message, which is truncated to 4075 bytes
after accounting for protocol headers. After reading a malformed length
field, a NOTIFY is generated that is supposed to contain the problematic
data, but the malformed length field is inadvertently used to compute
how much data we send.
CVE-2017-15865
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Diffstat (limited to 'doc/code/conf.py')
0 files changed, 0 insertions, 0 deletions