Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 695530 (CVE-2019-16159) - <net-misc/bird-2.0.7: incorrect logical expressionwhen checking the validity of an input message leads to stack-based buffer overflow (CVE-2019-16159)
Summary: <net-misc/bird-2.0.7: incorrect logical expressionwhen checking the validity ...
Status: RESOLVED FIXED
Alias: CVE-2019-16159
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-09-24 11:59 UTC by GLSAMaker/CVETool Bot
Modified: 2020-06-20 01:14 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-09-24 11:59:51 UTC 
CVE-2019-16159 (https://nvd.nist.gov/vuln/detail/CVE-2019-16159):
  BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a
  stack-based buffer overflow. The BGP daemon's support for RFC 8203
  administrative shutdown communication messages included an incorrect logical
  expression when checking the validity of an input message. Sending a
  shutdown communication with a sufficient message length causes a four-byte
  overflow to occur while processing the message, where two of the overflow
  bytes are attacker-controlled and two are fixed.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2019-09-24 12:01:36 UTC 
Package has no stable ebuild.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-22 22:10:30 UTC 
@maintainer(s), please cleanup!
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2020-04-26 03:54:17 UTC 
Maintainer(s), please drop the vulnerable version(s).
Comment 4 Larry the Git Cow gentoo-dev 2020-06-20 01:14:00 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3b234888717bd5e3377ac77a668f2686d3b98ead

commit 3b234888717bd5e3377ac77a668f2686d3b98ead
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2020-06-20 01:13:29 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2020-06-20 01:13:29 +0000

    net-misc/bird: drop vulnerable
    
    Bug: https://bugs.gentoo.org/695530
    Signed-off-by: Aaron Bauman <bman@gentoo.org>

 net-misc/bird/Manifest             |  9 -----
 net-misc/bird/bird-1.6.3-r1.ebuild | 68 --------------------------------------
 net-misc/bird/bird-1.6.4.ebuild    | 68 --------------------------------------
 net-misc/bird/bird-1.6.5.ebuild    | 68 --------------------------------------
 net-misc/bird/bird-1.6.6.ebuild    | 68 --------------------------------------
 net-misc/bird/bird-2.0.2.ebuild    | 36 --------------------
 net-misc/bird/bird-2.0.3.ebuild    | 36 --------------------
 net-misc/bird/bird-2.0.4.ebuild    | 36 --------------------
 net-misc/bird/bird-2.0.5.ebuild    | 36 --------------------
 net-misc/bird/bird-2.0.6.ebuild    | 36 --------------------
 10 files changed, 461 deletions(-)