Updated zebra packages that close a locally-exploitable and a remotely-exploitable denial of service vulnerability are now available.

Zebra an open source implementation of TCP/IP routing software.

Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0795 to this issue.

Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0858 to this issue.

Users of Zebra should upgrade to these erratum packages, which contain a patch preventing Zebra from crashing when it receives a telnet option delimiter without any option data, and a patch that checks that netlink messages actually came from the kernel.

自己報告されたバージョン番号によると、リモートホストでリッスンする Quagga の Zebra デーモンのインストールは、サービス拒否の脆弱性の影響を受けます。

根據其自我報告的版本號碼，在遠端主機上接聽之 Quagga 的 Zebra 程序的安裝受到一個拒絕服務弱點影響。

Zebra 和 Quagga 中存在一个拒绝服务漏洞，该漏洞可通过发送不含实际选项数据的 telnet 选项分隔符来触发，从而导致后台程序尝试取消引用通常为空的指针并使其崩溃。 

此漏洞影响从 0.90a 到 0.93b 的所有版本。

根据其自我报告的版本号，在远程主机上侦听的 Quagga 的 Zebra 后台程序的安装受到拒绝服务漏洞的影响。

Two vulnerabilities were discovered in zebra, an IP routing daemon :

  - CAN-2003-0795 - a bug in the telnet CLI could allow a     remote attacker to cause a zebra process to crash,     resulting in a denial of service.
  - CAN-2003-0858 - netlink messages sent by other users     (rather than the kernel) would be accepted, leading to a     denial of service.

A remote denial of service vulnerability exists in Zebra and Quagga that can be triggered by sending a telnet option delimiter with no actual option data, which causes the daemon to attempt to dereference a typically NULL pointer and crash. 

This affects all versions from 0.90a to 0.93b.

According to its self-reported version number, the installation of Quagga's Zebra daemon listening on the remote host is affected by a denial of service vulnerability.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
12427	RHEL 2.1 : zebra (RHSA-2003:305)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	medium
59786	0.96.4 より前の Quagga の Zebra におけるサービス拒否の脆弱性	Nessus	Misc.	2012/6/29	2018/11/15	medium
59786	Quagga < 0.96.4 Zebra 拒絕服務弱點	Nessus	Misc.	2012/6/29	2018/11/15	medium
11925	Quagga / Zebra 畸形 Telnet 命令拒绝服务	Nessus	Denial of Service	2003/11/17	2018/11/15	medium
59786	Quagga < 0.96.4 Zebra 拒绝服务漏洞	Nessus	Misc.	2012/6/29	2018/11/15	medium
15252	Debian DSA-415-1 : zebra - denial of service	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	medium
11925	Quagga / Zebra Malformed Telnet Command Denial of Service	Nessus	Denial of Service	2003/11/17	2018/11/15	medium
59786	Quagga < 0.96.4 Zebra Denial of Service Vulnerability	Nessus	Misc.	2012/6/29	2018/11/15	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium