DescriptionBIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs939990, 940522

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bird (PTS)stretch (security), stretch1.6.3-2+deb9u1fixed
buster, buster (security)1.6.6-1+deb10u1fixed
bullseye, sid1.6.8-2.1fixed
bird2 (PTS)bullseye, sid2.0.7-4.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
birdsourcejessie(not affected)
birdsourcestretch(not affected)


[stretch] - bird <not-affected> (Vulnerable code introduced later)
[jessie] - bird <not-affected> (Vulnerable code introduced later) (1.6.x) (2.0.x)

Search for package or bug name: Reporting problems