CVE-2003-0795

2003-12-1505:00:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2003-0795

quagga

zebra

telnet

security vulnerability

denial of service

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.2 Medium

AI Score

Confidence

Low

0.018 Low

EPSS

Percentile

88.1%

JSON

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

Affected configurations

NVD

Node

gnuzebraMatch0.91a

gnuzebraMatch0.92a

gnuzebraMatch0.93a

gnuzebraMatch0.93b

quaggaquaggaRange≤0.96.3

quaggaquaggaMatch0.95

quaggaquaggaMatch0.96

quaggaquaggaMatch0.96.1

quaggaquaggaMatch0.96.2

sgipropackMatch2.2.1

sgipropackMatch2.3

CPENameOperatorVersion
gnu:zebragnu zebraeq0.91a
gnu:zebragnu zebraeq0.92a
gnu:zebragnu zebraeq0.93a
gnu:zebragnu zebraeq0.93b
quagga:quaggaquaggale0.96.3
quagga:quaggaquaggaeq0.95
quagga:quaggaquaggaeq0.96
quagga:quaggaquaggaeq0.96.1
quagga:quaggaquaggaeq0.96.2
sgi:propacksgi propackeq2.2.1

CPE	Name	Operator	Version
gnu:zebra	gnu zebra	eq	0.91a
gnu:zebra	gnu zebra	eq	0.92a
gnu:zebra	gnu zebra	eq	0.93a
gnu:zebra	gnu zebra	eq	0.93b
quagga:quagga	quagga	le	0.96.3
quagga:quagga	quagga	eq	0.95
quagga:quagga	quagga	eq	0.96
quagga:quagga	quagga	eq	0.96.1
quagga:quagga	quagga	eq	0.96.2
sgi:propack	sgi propack	eq	2.2.1