According to its self-reported version number, the installation of Quagga's BGP daemon listening on the remote host is affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability can be triggered by a     malformed AS_PATHLIMIT path attribute. (CVE-2010-1675)

  - A denial of service vulnerability can be triggered by a     malformed extended communities attribute. (CVE-2010-1674)

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A NULL pointer dereference flaw was found in the way the bgpd daemon processed malformed route Extended Communities attributes. A configured BGP peer could crash bgpd on a target system via a specially crafted BGP message. (CVE-2010-1674)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249 and CVE-2012-0250. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249 and CVE-2012-0250.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

This security update of quagga fixes :

  - CVE-2010-1674: Direct BGP peers can send malformed     extended communities which lead to a NULL pointer     dereference.

  - CVE-2010-1675: A malformed AS_PATHLIMIT path attribute     will cause a session reset in Quagga. This malformed     package is forwarded by other routers and can be used to     take 'all' Quagga routers off the Internet with one     single announcement.

The remote Solaris system is missing necessary patches to address security updates :

  - bgpd in Quagga before 0.99.9 allows explicitly     configured BGP peers to cause a denial of service     (crash) via a malformed (1) OPEN message or (2) a     COMMUNITY attribute, which triggers a NULL pointer     dereference. NOTE: vector 2 only exists when debugging     is enabled. (CVE-2007-4826)

  - The BGP daemon (bgpd) in Quagga 0.99.11 and earlier     allows remote attackers to cause a denial of service     (crash) via an AS path containing ASN elements whose     string representation is longer than expected, which     triggers an assert error. (CVE-2009-1572)

  - The extended-community parser in bgpd in Quagga before     0.99.18 allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a malformed Extended Communities attribute.
    (CVE-2010-1674)

  - bgpd in Quagga before 0.99.18 allows remote attackers to     cause a denial of service (session reset) via a     malformed AS_PATHLIMIT path attribute. (CVE-2010-1675)

  - Stack-based buffer overflow in the     bgp_route_refresh_receive function in bgp_packet.c in     bgpd in Quagga before 0.99.17 allows remote     authenticated users to cause a denial of service (daemon     crash) or possibly execute arbitrary code via a     malformed Outbound Route Filtering (ORF) record in a BGP     ROUTE-REFRESH (RR) message. (CVE-2010-2948)

  - bgpd in Quagga before 0.99.17 does not properly parse AS     paths, which allows remote attackers to cause a denial     of service (NULL pointer dereference and daemon crash)     via an unknown AS type in an AS path attribute in a BGP     UPDATE message. (CVE-2010-2949)

  - The OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of     service (out-of-bounds memory access and daemon crash)     via a Link State Update message with an invalid IPv6     prefix length. (CVE-2011-3323)

  - The ospf6_lsa_is_changed function in ospf6_lsa.c in the     OSPFv3 implementation in ospf6d in Quagga before 0.99.19     allows remote attackers to cause a denial of service     (assertion failure and daemon exit) via trailing zero     values in the Link State Advertisement (LSA) header list     of an IPv6 Database Description message. (CVE-2011-3324)

  - ospf_packet.c in ospfd in Quagga before 0.99.19 allows     remote attackers to cause a denial of service (daemon     crash) via (1) a 0x0a type field in an IPv4 packet     header or (2) a truncated IPv4 Hello packet.
    (CVE-2011-3325)

  - The ospf_flood function in ospf_flood.c in ospfd in     Quagga before 0.99.19 allows remote attackers to cause a     denial of service (daemon crash) via an invalid Link     State Advertisement (LSA) type in an IPv4 Link State     Update message. (CVE-2011-3326)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
59789	Quagga < 0.99.18 BGPD Multiple Denial of Service Vulnerabilities	Nessus	Misc.	2012/6/29	2018/11/15	medium
62094	Scientific Linux Security Update : quagga on SL5.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	2012/9/14	2021/1/14	high
53796	openSUSE Security Update : quagga (openSUSE-SU-2011:0274-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	medium
80751	Oracle Solaris Third-Party Patch Update : quagga (multiple_denial_of_service_vulnerabilities4)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium

检测

插件搜索

medium

high

medium

medium