This update fixes the following security issues :

  - 718056: OSPF6D buffer overflow while decoding Link State     Update with Inter Area Prefix Lsa. (CVE-2011-3323)

  - 718058: OSPF6D DoS while decoding Database Description     packet. (CVE-2011-3324)

  - 718059: OSPFD DoS while decoding Hello packet.
    (CVE-2011-3325)

  - 718061: OSPFD DoS while decoding Link State Update.
    (CVE-2011-3326)

  - 718062: DoS while decoding EXTENDED_COMMUNITIES in     Quagga's BGP (CVE-2011-3327)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1258 advisory.

  - quagga: DoS (crash) by processing malformed extended community attribute in a route (CVE-2010-1674)

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory.

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

  - quagga (bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message     (CVE-2012-0255)

  - quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV     (VU#962587) (CVE-2012-1820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
57132	SuSE 11.1 Security Update : quagga (SAT Patch Number 5169)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
62069	RHEL 5 : quagga (RHSA-2012:1258)	Nessus	Red Hat Local Security Checks	2012/9/13	2024/4/27	high
62070	RHEL 6 : quagga (RHSA-2012:1259)	Nessus	Red Hat Local Security Checks	2012/9/13	2024/4/27	high
62095	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	2012/9/14	2021/1/14	high

检测

插件搜索

high

high

high

high