The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3102-1 advisory.

    It was discovered that Quagga incorrectly handled dumping data. A remote attacker could possibly use a     large BGP packet to cause Quagga to crash, resulting in a denial of service. (CVE-2016-4049)

    It was discovered that the Quagga package incorrectly set permissions on the configuration directory. A     local user could use this issue to possibly obtain sensitive information. (CVE-2016-4036)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update addresses multiple security problems and fixes systemd dependencies.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-48 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted packet possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94068	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3102-1)	Nessus	Ubuntu Local Security Checks	2016/10/14	2024/8/27	medium
94524	Fedora 23 : quagga (2016-568c7ff4f6)	Nessus	Fedora Local Security Checks	2016/11/4	2026/1/20	critical
95010	Fedora 25 : quagga (2016-8acc6b66f1)	Nessus	Fedora Local Security Checks	2016/11/21	2026/1/16	critical
96683	GLSA-201701-48 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/23	2026/1/5	critical
97961	CentOS 6 : quagga (CESA-2017:0794)	Nessus	CentOS Local Security Checks	2017/3/27	2025/12/29	critical
94526	Fedora 24 : quagga (2016-cae6456f63)	Nessus	Fedora Local Security Checks	2016/11/4	2026/1/20	critical

检测

插件搜索

medium

critical

critical

critical

critical

critical