This update of quagga fixes multiple security flaws that could have caused a Denial of Service via specially crafted packets.
(CVE-2012-1820 / CVE-2012-0249 / CVE-2012-0250 / CVE-2012-0255)

Additionally, issues with service owned directories in combination with logrotate were fixed.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory.

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

  - quagga (bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message     (CVE-2012-0255)

  - quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV     (VU#962587) (CVE-2012-1820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1259 advisory.

    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250
    - fix CVE-2012-1820
    - Resolves: #684751 - CVE-2010-1674 CVE-2010-1675 quagga various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201310-08 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause arbitrary code execution or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - ImageMagick 6.7.5-7 and earlier allows remote attackers     to cause a denial of service (infinite loop and hang)     via a crafted image whose IFD contains IOP tags that all     reference the beginning of the IDF. (CVE-2012-0248)

  - Buffer overflow in the ospf_ls_upd_list_lsa function in     ospf_packet.c in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (assertion failure and daemon exit)     via a Link State Update (aka LS Update) packet that is     smaller than the length specified in its header.
    (CVE-2012-0249)

  - Buffer overflow in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (daemon crash) via a Link State     Update (aka LS Update) packet containing a network-LSA     link-state advertisement for which the data-structure     length is smaller than the value in the Length header     field. (CVE-2012-0250)

  - The BGP implementation in bgpd in Quagga before     0.99.20.1 does not properly use message buffers for OPEN     messages, which allows remote attackers to cause a     denial of service (assertion failure and daemon exit)     via a message associated with a malformed Four-octet AS     Number Capability (aka AS4 capability). (CVE-2012-0255)

  - The bgp_capability_orf function in bgpd in Quagga     0.99.20.1 and earlier allows remote attackers to cause a     denial of service (assertion failure and daemon exit) by     leveraging a BGP peering relationship and sending a     malformed Outbound Route Filtering (ORF) capability TLV     in an OPEN message. (CVE-2012-1820)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-989:01 advisory.

    Quagga is a free software that manages TCP/IP based routing protocol. It takes multi-server and multi-     thread approach to resolve the current complexity of the Internet.
    Quagga supports BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng.
    Quagga is intended to be used as a Route Server and a Route Reflector. It is not a toolkit, it provides     full routing power under a new architecture. Quagga by design has a process for each protocol.
    Quagga is a fork of GNU Zebra.
    Security issues fixed with this release:
     CVE-2011-3323     The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of     service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid     IPv6 prefix length.
     CVE-2011-3324     The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via     trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description     message.
     CVE-2011-3325     ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service     (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.
     CVE-2011-3326     The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause     a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link     State Update message.
     CVE-2011-3327     Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga     before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute     arbitrary code by sending a crafted BGP UPDATE message over IPv4.
     CVE-2012-0249     Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in     ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure     and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified     in its header.
     CVE-2012-0250     Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers     to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a     network-LSA link-state advertisement for which the data-structure length is smaller than the value in the     Length header field.
     CVE-2012-0255     The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN     messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit)     via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).
     CVE-2012-1820     The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a     denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending     a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

fixes CVEs, updates to latest upstream quagga-0.99.20.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Quagga, a routing daemon.

  - CVE-2012-0249     A buffer overflow in the ospf_ls_upd_list_lsa function     in the OSPFv2 implementation allows remote attackers to     cause a denial of service (assertion failure and daemon     exit) via a Link State Update (aka LS Update) packet     that is smaller than the length specified in its header.

  - CVE-2012-0250     A buffer overflow in the OSPFv2 implementation allows     remote attackers to cause a denial of service (daemon     crash) via a Link State Update (aka LS Update) packet     containing a network-LSA link-state advertisement for     which the data-structure length is smaller than the     value in the Length header field.

  - CVE-2012-0255     The BGP implementation does not properly use message     buffers for OPEN messages, which allows remote attackers     impersonating a configured BGP peer to cause a denial of     service (assertion failure and daemon exit) via a     message associated with a malformed AS4 capability.

This security update upgrades the quagga package to the most recent upstream release. This release includes other corrections, such as hardening against unknown BGP path attributes.

Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol.
The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamaki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

It was discovered that Quagga incorrectly handled Link State Update messages with invalid lengths. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service.
(CVE-2012-0249, CVE-2012-0250)

It was discovered that Quagga incorrectly handled messages with a malformed Four-octet AS Number Capability. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service.
(CVE-2012-0255).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the installation of Quagga listening on the remote host is affected by multiple vulnerabilities :

  - A buffer overflow vulnerability exists in OSPFD can be     triggered by a specially crafted Link Status Update     message that is smaller than the length specified in     its header, leading to denial of service.
    (CVE-2012-0249)

  - A buffer overflow vulnerability in exists OSPFD can be     triggered by a specially crafted Link Status Update     message containing a network-LSA link-state     advertisement for which the data-structure length is     smaller than the value in the Length header field,     leading to denial of service. (CVE-2012-0250)

  - A denial of service vulnerability exists in BGPD that     can be triggered by a specially crafted OPEN message     with a malformed four-octet AS Number Capability.
    (CVE-2012-0250)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
59393	SuSE 10 Security Update : quagga (ZYPP Patch Number 8108)	Nessus	SuSE Local Security Checks	2012/6/7	2021/1/19	medium
64222	SuSE 11.1 Security Update : quagga (SAT Patch Number 6241)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
62070	RHEL 6 : quagga (RHSA-2012:1259)	Nessus	Red Hat Local Security Checks	2012/9/13	2024/4/27	high
62095	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	2012/9/14	2021/1/14	high
68618	Oracle Linux 6 : quagga (ELSA-2012-1259)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	high
70381	GLSA-201310-08 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2013/10/11	2021/1/6	medium
80752	Oracle Solaris Third-Party Patch Update : quagga (cve_2012_1820_denial_of)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
284057	MiracleLinux 4 : quagga-0.99.15-7.AXS4.2 (AXSA:2012-989:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
58805	Fedora 17 : quagga-0.99.20.1-1.fc17 (2012-5352)	Nessus	Fedora Local Security Checks	2012/4/20	2021/1/11	medium
58883	Debian DSA-2459-2 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	2012/4/27	2021/1/11	medium
62081	CentOS 6 : quagga (CESA-2012:1259)	Nessus	CentOS Local Security Checks	2012/9/14	2021/1/4	high
59107	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : quagga vulnerabilities (USN-1441-1)	Nessus	Ubuntu Local Security Checks	2012/5/16	2019/9/19	medium
58819	Fedora 16 : quagga-0.99.20.1-1.fc16 (2012-5411)	Nessus	Fedora Local Security Checks	2012/4/23	2021/1/11	medium
59791	Quagga < 0.99.20.1 Multiple Vulnerabilities	Nessus	Misc.	2012/6/29	2018/7/25	medium

检测

插件搜索

medium

medium

high

high

high

medium

medium

high

medium

medium

high

medium

medium

medium