NetSight
IP …
medium5.0Public exploit code

CVE-2003-0795

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which a…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

Affected products

VendorProductAffected versions
GnuZebra
Versions 0.91a, 0.92a, 0.93a, 0.93b
QuaggaQuagga
through 0.96.3
Versions 0.95, 0.96, 0.96.1, 0.96.2
SgiPropack
Versions 2.2.1, 2.3

Weakness classification

CWE-20

References