bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

From Red Hat Security Advisory 2007:0389 :

An updated quagga package that fixes a security bug is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga is a TCP/IP based routing software suite.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

All users of Quagga should upgrade to this updated package, which contains a backported patch to correct these issues.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

According to its self-reported version number, the installation of Quagga's BGP daemon listening on the remote host is affected by a denial of service vulnerability. The issue can be triggered by a specially crafted UPDATE message from an explicitly configured BGP peer.

Remote attackers could crash quagga via specially crafted 'UPDATE' messages. (CVE-2007-1995)

It was discovered that Quagga did not correctly verify length information sent from configured peers. Remote malicious peers could send a specially crafted UPDATE message which would cause bgpd to abort, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to new upstream 0.99.7 should also fix the CVE-2007-1995 Quagga bgpd DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Remote attackers could crash quagga via specially crafted 'UPDATE' messages (CVE-2007-1995).

An updated quagga package that fixes a security bug is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga is a TCP/IP based routing software suite.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

All users of Quagga should upgrade to this updated package, which contains a backported patch to correct these issues.

Paul Jakma discovered that specially crafted UPDATE messages can trigger an out of boundary read that can result in a system crash of quagga, the BGP/OSPF/RIP routing daemon.

The remote host is affected by the vulnerability described in GLSA-200705-05 (Quagga: Denial of Service)

    The Quagga development team reported a vulnerability in the BGP routing     deamon when processing NLRI attributes inside UPDATE messages.
  Impact :

    A malicious peer inside a BGP area could send a specially crafted     packet to a Quagga instance, possibly resulting in a crash of the     Quagga daemon.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67506	Oracle Linux 3 / 4 / 5 : quagga (ELSA-2007-0389)	Nessus	Oracle Linux Local Security Checks	medium
60193	Scientific Linux Security Update : quagga on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59794	Quagga < 0.98.7 / 0.99.7 BGPD Denial of Service Vulnerability	Nessus	Misc.	medium
29567	SuSE 10 Security Update : quagga (ZYPP Patch Number 3230)	Nessus	SuSE Local Security Checks	medium
28061	Ubuntu 6.06 LTS / 6.10 / 7.04 : quagga vulnerability (USN-461-1)	Nessus	Ubuntu Local Security Checks	medium
27682	Fedora 7 : quagga-0.99.7-1.fc7 (2007-0838)	Nessus	Fedora Local Security Checks	medium
27417	openSUSE 10 Security Update : quagga (quagga-3233)	Nessus	SuSE Local Security Checks	medium
25363	RHEL 3 / 4 / 5 : quagga (RHSA-2007:0389)	Nessus	Red Hat Local Security Checks	medium
25354	CentOS 3 / 4 / 5 : quagga (CESA-2007:0389)	Nessus	CentOS Local Security Checks	medium
25258	Debian DSA-1293-1 : quagga - out of boundary read	Nessus	Debian Local Security Checks	medium
25155	GLSA-200705-05 : Quagga: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-1995

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium