This update addresses multiple security problems and fixes systemd dependencies.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-48 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted packet possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be     compatible with a message size; however, BUFSIZ is system-dependent. (CVE-2016-1245)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that there was stack overrun in IPv6 RA receive code in quagga, a BGP/OSPF/RIP routing daemon.

The buffer size specified when receiving mixed up two constants that have different values.

For Debian 7 'Wheezy', this issue has been fixed in quagga version 0.99.22.4-1+wheezy3+deb7u1.

We recommend that you upgrade your quagga packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following issues :

  - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA     receive code (bsc#1005258).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following issue :

  - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA     receive code (bsc#1005258).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3110-1 advisory.

    David Lamparter discovered that Quagga incorrectly handled certain IPv6 router advertisements. A remote     attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for quagga fixes the following issue :

  - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA     receive code. (bsc#1005258).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94524	Fedora 23 : quagga (2016-568c7ff4f6)	Nessus	Fedora Local Security Checks	2016/11/4	2026/1/20	critical
95010	Fedora 25 : quagga (2016-8acc6b66f1)	Nessus	Fedora Local Security Checks	2016/11/21	2026/1/16	critical
96683	GLSA-201701-48 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/23	2026/1/5	critical
97961	CentOS 6 : quagga (CESA-2017:0794)	Nessus	CentOS Local Security Checks	2017/3/27	2025/12/29	critical
130690	EulerOS 2.0 SP5 : quagga (EulerOS-SA-2019-2228)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/15	critical
219375	Linux Distros Unpatched Vulnerability : CVE-2016-1245	Nessus	Misc.	2025/3/4	2025/9/3	critical
94110	Debian DLA-662-1 : quagga security update	Nessus	Debian Local Security Checks	2016/10/19	2026/1/21	critical
94273	SUSE SLES11 Security Update : quagga (SUSE-SU-2016:2569-1)	Nessus	SuSE Local Security Checks	2016/10/26	2026/1/21	critical
94282	SUSE SLES12 Security Update : quagga (SUSE-SU-2016:2618-1)	Nessus	SuSE Local Security Checks	2016/10/26	2026/1/21	critical
94288	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerability (USN-3110-1)	Nessus	Ubuntu Local Security Checks	2016/10/26	2024/8/27	critical
94308	openSUSE Security Update : quagga (openSUSE-2016-1233)	Nessus	SuSE Local Security Checks	2016/10/27	2026/1/20	critical
94526	Fedora 24 : quagga (2016-cae6456f63)	Nessus	Fedora Local Security Checks	2016/11/4	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical