Check Point Advisories

Quagga BGP Daemon bgp_capability_msg_parse Denial-of-Service (CVE-2018-5381)

Vulnerability
Protection

Check Point Reference:	CPAI-2019-0209
Date Published:	17 Feb 2019
Severity:	Medium
Last Updated:	Tuesday 02 November, 2021
Source:	Quagga
Industry Reference:	CVE-2018-5381
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	Quagga Quagga prior to 1.2.3
Vulnerability Description	A denial-of-service vulnerability has been reported in the BGP Daemon of Quagga. The vulnerability is due to improper handling of Multiprotocol Extensions Capabilities within certain BGP messages. A remote attacker could exploit this vulnerability by sending a crafted BGP message to the target server.

Protection Overview

This protection detects attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75

In the IPS tab, click Protections and find the Quagga BGP Daemon bgp_capability_msg_parse Denial-of-Service protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Application Servers Protection Violation.
Attack Information: Quagga BGP Daemon bgp_capability_msg_parse Denial-of-Service