DescriptionBIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs939990, 940522

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bird (PTS)buster, buster (security)1.6.6-1+deb10u1fixed
bookworm, sid, bullseye1.6.8-2.1fixed
bird2 (PTS)bullseye2.0.7-4.1fixed
bookworm, sid2.0.12-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
birdsourcejessie(not affected)
birdsourcestretch(not affected)


[stretch] - bird <not-affected> (Vulnerable code introduced later)
[jessie] - bird <not-affected> (Vulnerable code introduced later) (1.6.x) (2.0.x)

Search for package or bug name: Reporting problems