CVE-2003-0795: GNU Zebra

Medium severity, CVSS 5.0. EPSS: 8.4% chance of exploitation in the next 30 days.

The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

Affected products

• GNU Zebra: version 0.91a only; version 0.92a only; version 0.93a only; version 0.93b only
• Quagga Quagga: up to and including 0.96.3; version 0.95 only; version 0.96 only; version 0.96.1 only; version 0.96.2 only
• Sgi Propack: version 2.2.1 only; version 2.3 only

Published 2003-12-15. Last modified 2026-06-16.