The vty layer in Quagga before 0.96.4 and Zebra 0.93b and earlier does not verify that sub-negotiation is taking place when processing the SE marker which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port which may trigger a null dereference.