An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

This update for quagga fixes the following security issues :

  - CVE-2016-4049: Remote crash vulnerability with specially     crafted packages due to a buffer overflow error in     bgp_dump_routes_func (boo#977012)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping     data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash)     via a large BGP packet. (CVE-2016-4049)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0794 advisory.

    - Resolves: #1416013 - CVE-2017-5495 quagga: Telnet interface input buffer allocates unbounded amounts of     memory
    - fix for CVE-2013-2236 (#1391918)
    - fix for CVE-2016-1245 (#1391914)
    - fix for CVE-2016-2342 (#1391916)
    - fix for CVE-2016-4049 (#1391919)
    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A stack-based buffer overflow flaw was found in the way     Quagga handled IPv6 router advertisement messages. A     remote attacker could use this flaw to crash the zebra     daemon resulting in denial of service. (CVE-2016-1245)

  - A stack-based buffer overflow flaw was found in the way     the Quagga BGP routing daemon (bgpd) handled Labeled-VPN     SAFI routes data. A remote attacker could use this flaw     to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-2342)

  - A denial of service flaw was found in the Quagga BGP     routing daemon (bgpd). Under certain circumstances, a     remote attacker could send a crafted packet to crash the     bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash. (CVE-2017-5495)

  - A stack-based buffer overflow flaw was found in the way     the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this     flaw to crash the ospfd daemon resulting in denial of     service. (CVE-2013-2236)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2017-1369:01 advisory.

    Quagga is a free software that manages TCP/IP based routing     protocol. It takes multi-server and multi-thread approach to resolve     the current complexity of the Internet.
    Quagga supports BGP4, BGP4 , OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng.
    Quagga is intended to be used as a Route Server and a Route Reflector. It is     not a toolkit, it provides full routing power under a new architecture.
    Quagga by design has a process for each protocol.
    Quagga is a fork of GNU Zebra.
    Security issues fixed with this release:
    CVE-2013-2236     Stack-based buffer overflow in the new_msg_lsa_change_notify function     in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when
    --enable-opaque-lsa and the -a command line option are used, allows     remote attackers to cause a denial of service (crash) via a large LSA.
    CVE-2016-1245     It was discovered that the zebra daemon in Quagga before 1.0.20161017     suffered from a stack-based buffer overflow when processing IPv6     Neighbor Discovery messages. The root cause was relying on BUFSIZ to be     compatible with a message size; however, BUFSIZ is system-dependent.
    CVE-2016-2342     The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI     parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4     configuration is used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers to execute     arbitrary code or cause a denial of service (stack-based buffer     overflow) via a crafted packet.
    CVE-2016-4049     The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does     not perform size checks when dumping data, which might allow remote     attackers to cause a denial of service (assertion failure and daemon     crash) via a large BGP packet.
    CVE-2017-5495     All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an     unbounded memory allocation in the telnet 'vty' CLI, leading to a     Denial-of-Service of Quagga daemons, or even the entire host. When     Quagga daemons are configured with their telnet CLI enabled, anyone who     can connect to the TCP ports can trigger this vulnerability, prior to     authentication. Most distributions restrict the Quagga telnet interface     to local access only by default. The Quagga telnet interface 'vty'     input buffer grows automatically, without bound, so long as a newline     is not entered. This allows an attacker to cause the Quagga daemon to     allocate unbounded memory by sending very long strings without a     newline. Eventually the daemon is terminated by the system, or the     system itself runs out of memory. This is fixed in Quagga 1.1.1 and     Free Range Routing (FRR) Protocol Suite 2017-01-10.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses multiple security problems and fixes systemd dependencies.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97961	CentOS 6 : quagga (CESA-2017:0794)	Nessus	CentOS Local Security Checks	2017/3/27	2025/12/29	critical
91208	openSUSE Security Update : quagga (openSUSE-2016-591)	Nessus	SuSE Local Security Checks	2016/5/18	2021/1/19	high
219656	Linux Distros Unpatched Vulnerability : CVE-2016-4049	Nessus	Misc.	2025/3/4	2025/9/3	high
99073	Oracle Linux 6 : quagga (ELSA-2017-0794)	Nessus	Oracle Linux Local Security Checks	2017/3/30	2024/10/23	critical
99223	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20170321)	Nessus	Scientific Linux Local Security Checks	2017/4/6	2025/12/26	critical
289473	MiracleLinux 4 : quagga-0.99.15-14.AXS4 (AXSA:2017-1369:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
132192	EulerOS 2.0 SP3 : quagga (EulerOS-SA-2019-2657)	Nessus	Huawei Local Security Checks	2019/12/18	2022/12/5	critical
94526	Fedora 24 : quagga (2016-cae6456f63)	Nessus	Fedora Local Security Checks	2016/11/4	2026/1/20	critical

检测

插件搜索

critical

high

high

critical

critical

critical

critical

critical