CVE-2016-2342
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga...
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
- Record
CVE-2016-2342- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
- Record
CVE-2016-2342- Updated
- 2026-11-02
EUVDEUVD-2016-3426 No score
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
- Record
EUVD-2016-3426- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jm86-8c92-649g
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga...
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
- Record
GHSA-jm86-8c92-649g- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVRHSA-2017:0794
Red Hat Security Advisory: quagga security and bug fix update
- Record
RHSA-2017:0794- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2342
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
- Record
UBUNTU-CVE-2016-2342- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2016-0126 No score
Updated quagga packages fix security vulnerability
A vulnerability was found in a way VPNv4 NLRI parser copied packet data to the stack. Memcpy to stack data structure based on length field from packet data whose length field upper-bound was not properly checked (CVE-2016-2342).
- Record
MGASA-2016-0126- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10362-1 No score
libospf0-1.0.20160315-5.1 on GA media
These are all security issues fixed in the libospf0-1.0.20160315-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10362-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0936-1 No score
Security update for quagga
This update for quagga fixes the following security issue:
- CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952).
- Record
SUSE-SU-2016:0936-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0946-1 No score
Security update for quagga
This update for quagga fixes the following security issue:
- CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952).
- Record
SUSE-SU-2016:0946-1- Updated
- 2026-11-02
OSVUSN-2941-1 No score
quagga vulnerabilities
Kostya Kortchinsky discovered that Quagga incorrectly handled certain route data when configured with BGP peers enabled for VPNv4. A remote attacker could use this issue to cause Quagga to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2342)
It was discovered that Quagga incorrectly handled messages with a large LSA when used in certain configurations. A remote attacker could use this issue to cause Quagga to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-2236)
- Record
USN-2941-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
quaggaDebian:7 |
before 0.99.22.4-1+wheezy2, plus listed versions 0.99.21-4+wheezy10.99.21-4+wheezy20.99.22-10.99.22.1-10.99.22.1-20.99.22.4-10.99.22.4-1+wheezy1 |
0.99.22.4-1+wheezy2 |
quaggaDebian:8 |
before 0.99.23.1-1+deb8u1, plus listed versions 0.99.23.1-1 |
0.99.23.1-1+deb8u1 |
quaggaMageia:5 |
before 0.99.22.4-4.1.mga5 | 0.99.22.4-4.1.mga5 |
quagga-contribRed Hat:enterprise_linux:6::server |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quagga-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quagga-develRed Hat:enterprise_linux:6::server |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quaggaRed Hat:enterprise_linux:6::server |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quagga-contribRed Hat:enterprise_linux:6::workstation |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quagga-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quagga-develRed Hat:enterprise_linux:6::workstation |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
quaggaRed Hat:enterprise_linux:6::workstation |
before 0:0.99.15-14.el6 | 0:0.99.15-14.el6 |
quaggaSUSE:Linux Enterprise Software Development Kit 12 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Server 12 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Server for SAP Applications 12 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Server 12 SP1 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 0.99.22.1-5.1 | 0.99.22.1-5.1 |
quaggaSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.99.15-0.16.1 | 0.99.15-0.16.1 |
quaggaSUSE:Linux Enterprise Server 11 SP4 |
before 0.99.15-0.16.1 | 0.99.15-0.16.1 |
quaggaSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 0.99.15-0.16.1 | 0.99.15-0.16.1 |
quaggaUbuntu:14.04:LTS |
before 0.99.22.4-3ubuntu1.1, plus listed versions 0.99.22.1-20.99.22.4-10.99.22.4-20.99.22.4-30.99.22.4-3ubuntu1 |
0.99.22.4-3ubuntu1.1 |
quaggaopenSUSE:Tumbleweed |
before 1.0.20160315-5.1 | 1.0.20160315-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-2342 is a high vulnerability (CVSS 8.1) in Quagga, published March 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. Fixed in quagga 0.99.22.4-1+wheezy2.
References
securityfocus.com/bid/84318
rhn.redhat.com/errata/RHSA-2017-0794.html
lists.opensuse.org/opensuse-updates/2016-03/msg00102.html
debian.org/security/2016/dsa-3532
kb.cert.org/vuls/id/270232
git.savannah.gnu.org/cgit/quagga.git/commit?id=a3bc7e9400b214a0f078fdb19596ba54214a1442
Show 51 moreShow less
security.gentoo.org/glsa/201610-03
oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
nongnu.askapache.com//quagga/quagga-1.0.20160309.changelog.txt
ubuntu.com/usn/USN-2941-1
nvd.nist.gov/vuln/detail/CVE-2016-2342
github.com/advisories/GHSA-jm86-8c92-649g
advisories.mageia.org/MGASA-2016-0126.html
bugs.mageia.org/show_bug.cgi?id=18060
access.redhat.com/errata/RHSA-2017:0794
bugzilla.redhat.com/show_bug.cgi?id=674862
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0794.json
cve.org/CVERecord?id=CVE-2013-2236
mirror.easyname.at/nongnu//quagga/quagga-1.0.20160309.changelog.txt
openwall.com/lists/oss-security/2016/04/27/7
lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html
suse.com/support/update/announcement/2016/suse-su-20160936-1
bugzilla.suse.com/970952
ubuntu.com/security/CVE-2016-2342