The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.

According to its self-reported version number, the installation of Quagga's Zebra daemon listening on the remote host is affected by a denial of service vulnerability.

Two vulnerabilities were discovered in zebra, an IP routing daemon :

  - CAN-2003-0795 - a bug in the telnet CLI could allow a     remote attacker to cause a zebra process to crash,     resulting in a denial of service.
  - CAN-2003-0858 - netlink messages sent by other users     (rather than the kernel) would be accepted, leading to a     denial of service.

Updated zebra packages that close a locally-exploitable and a remotely-exploitable denial of service vulnerability are now available.

Zebra an open source implementation of TCP/IP routing software.

Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0795 to this issue.

Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0858 to this issue.

Users of Zebra should upgrade to these erratum packages, which contain a patch preventing Zebra from crashing when it receives a telnet option delimiter without any option data, and a patch that checks that netlink messages actually came from the kernel.

A remote denial of service vulnerability exists in Zebra and Quagga that can be triggered by sending a telnet option delimiter with no actual option data, which causes the daemon to attempt to dereference a typically NULL pointer and crash. 

This affects all versions from 0.90a to 0.93b.

ID	Name	Product	Family	Severity
59786	Quagga < 0.96.4 Zebra Denial of Service Vulnerability	Nessus	Misc.	medium
15252	Debian DSA-415-1 : zebra - denial of service	Nessus	Debian Local Security Checks	medium
12427	RHEL 2.1 : zebra (RHSA-2003:305)	Nessus	Red Hat Local Security Checks	medium
11925	Quagga / Zebra Malformed Telnet Command Denial of Service	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2003-0795

high

Tenable Plugins

medium

medium

medium

medium