The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via     trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description     message. (CVE-2011-3324)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Solaris system is missing necessary patches to address security updates :

  - bgpd in Quagga before 0.99.9 allows explicitly     configured BGP peers to cause a denial of service     (crash) via a malformed (1) OPEN message or (2) a     COMMUNITY attribute, which triggers a NULL pointer     dereference. NOTE: vector 2 only exists when debugging     is enabled. (CVE-2007-4826)

  - The BGP daemon (bgpd) in Quagga 0.99.11 and earlier     allows remote attackers to cause a denial of service     (crash) via an AS path containing ASN elements whose     string representation is longer than expected, which     triggers an assert error. (CVE-2009-1572)

  - The extended-community parser in bgpd in Quagga before     0.99.18 allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a malformed Extended Communities attribute.
    (CVE-2010-1674)

  - bgpd in Quagga before 0.99.18 allows remote attackers to     cause a denial of service (session reset) via a     malformed AS_PATHLIMIT path attribute. (CVE-2010-1675)

  - Stack-based buffer overflow in the     bgp_route_refresh_receive function in bgp_packet.c in     bgpd in Quagga before 0.99.17 allows remote     authenticated users to cause a denial of service (daemon     crash) or possibly execute arbitrary code via a     malformed Outbound Route Filtering (ORF) record in a BGP     ROUTE-REFRESH (RR) message. (CVE-2010-2948)

  - bgpd in Quagga before 0.99.17 does not properly parse AS     paths, which allows remote attackers to cause a denial     of service (NULL pointer dereference and daemon crash)     via an unknown AS type in an AS path attribute in a BGP     UPDATE message. (CVE-2010-2949)

  - The OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of     service (out-of-bounds memory access and daemon crash)     via a Link State Update message with an invalid IPv6     prefix length. (CVE-2011-3323)

  - The ospf6_lsa_is_changed function in ospf6_lsa.c in the     OSPFv3 implementation in ospf6d in Quagga before 0.99.19     allows remote attackers to cause a denial of service     (assertion failure and daemon exit) via trailing zero     values in the Link State Advertisement (LSA) header list     of an IPv6 Database Description message. (CVE-2011-3324)

  - ospf_packet.c in ospfd in Quagga before 0.99.19 allows     remote attackers to cause a denial of service (daemon     crash) via (1) a 0x0a type field in an IPv4 packet     header or (2) a truncated IPv4 Hello packet.
    (CVE-2011-3325)

  - The ospf_flood function in ospf_flood.c in ospfd in     Quagga before 0.99.19 allows remote attackers to cause a     denial of service (daemon crash) via an invalid Link     State Advertisement (LSA) type in an IPv4 Link State     Update message. (CVE-2011-3326)

This update fixes the following security issues :

  - 718056: OSPF6D buffer overflow while decoding Link State     Update with Inter Area Prefix Lsa (CVE-2011-3323)

  - 718058: OSPF6D DoS while decoding Database Description     packet (CVE-2011-3324)

  - 718059: OSPFD DoS while decoding Hello packet     (CVE-2011-3325)

  - 718061: OSPFD DoS while decoding Link State Update     (CVE-2011-3326)

  - 718062: DoS while decoding EXTENDED_COMMUNITIES in     Quagga's BGP (CVE-2011-3327)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1259 advisory.

    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250
    - fix CVE-2012-1820
    - Resolves: #684751 - CVE-2010-1674 CVE-2010-1675 quagga various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1258 advisory.

    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0249
    - fix CVE-2010-1674
    - Resolves: #638628 - CVE-2007-4826 CVE-2010-2948 quagga: various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A NULL pointer dereference flaw was found in the way the bgpd daemon processed malformed route Extended Communities attributes. A configured BGP peer could crash bgpd on a target system via a specially crafted BGP message. (CVE-2010-1674)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249 and CVE-2012-0250. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249 and CVE-2012-0250.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol.
The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamaki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory.

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

  - quagga (bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message     (CVE-2012-0255)

  - quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV     (VU#962587) (CVE-2012-1820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1258 advisory.

  - quagga: DoS (crash) by processing malformed extended community attribute in a route (CVE-2010-1674)

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol.
The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A NULL pointer dereference flaw was found in the way the bgpd daemon processed malformed route Extended Communities attributes. A configured BGP peer could crash bgpd on a target system via a specially crafted BGP message. (CVE-2010-1674)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249 and CVE-2012-0250. CERT-FI acknowledges Riku Hietamaki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249 and CVE-2012-0250.

Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

According to its self-reported version number, the installation of Quagga listening on the remote host is affected by multiple vulnerabilities :

  - A denial of service vulnerability in OSPF6D can be     triggered by a specially crafted Link Status Update     message with an invalid IPv6 prefix length.
    (CVE-2011-3323)

  - A denial of service vulnerability in OSPF6D can be     triggered by a specially crafted IPv6 Database     Description message with trailing zero values in the     Link State Advertisement header list. (CVE-2011-3324)

  - A denial of service vulnerability in OSPFD can be     triggered by a 0x0A type field in an IPv4 packet header     or a truncated IPv4 Hello packet. (CVE-2011-3325)

  - A denial of service vulnerability in OSPFD can be     triggered by a specially crafted IPv4 Link State Update     message with an invalid Link State Advertisement type.
    (CVE-2011-3326)

  - A heap-based buffer overflow in BGPD can be triggered by     a specially crafted UPDATE message over IPv4.
    (CVE-2011-3326)

The remote host is affected by the vulnerability described in GLSA-201202-02 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A BGP peer could send a Route-Refresh message with specially crafted ORF       record, which can cause Quagga's bgpd to crash or possibly execute       arbitrary code with the privileges of the user running Quagga's bgpd; a       BGP update AS path request with unknown AS type, or malformed       AS-Pathlimit or Extended-Community attributes could lead to Denial of       Service (daemon crash), an error in bgpd when handling AS_PATH attributes       within UPDATE messages can       be exploited to cause a heap-based buffer overflow resulting in a crash       of the       daemon and disruption of IPv4 routing, two errors in ospf6d and ospfd can       each be exploited to crash the daemon and disrupt IP routing.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security issues :

  - 718056: OSPF6D buffer overflow while decoding Link State     Update with Inter Area Prefix Lsa. (CVE-2011-3323)

  - 718058: OSPF6D DoS while decoding Database Description     packet. (CVE-2011-3324)

  - 718059: OSPFD DoS while decoding Hello packet.
    (CVE-2011-3325)

  - 718061: OSPFD DoS while decoding Link State Update.
    (CVE-2011-3326)

  - 718062: DoS while decoding EXTENDED_COMMUNITIES in     Quagga's BGP. (CVE-2011-3327)

This update fixes the following security issues :

  - 718056: OSPF6D buffer overflow while decoding Link State     Update with Inter Area Prefix Lsa. (CVE-2011-3323)

  - 718058: OSPF6D DoS while decoding Database Description     packet. (CVE-2011-3324)

  - 718059: OSPFD DoS while decoding Hello packet.
    (CVE-2011-3325)

  - 718061: OSPFD DoS while decoding Link State Update.
    (CVE-2011-3326)

  - 718062: DoS while decoding EXTENDED_COMMUNITIES in     Quagga's BGP (CVE-2011-3327)

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled Link State Update messages with invalid lengths. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service. (CVE-2011-3323)

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled certain IPv6 Database Description messages.
A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service. (CVE-2011-3324)

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled certain IPv4 packets. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service. (CVE-2011-3325)

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled invalid Link State Advertisement (LSA) types. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service. (CVE-2011-3326)

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could use this flaw to cause Quagga to crash, or possibly execute arbitrary code. (CVE-2011-3327).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fixes CVE-2011-332{3..7} update to latest upstream 0.99.20 fixes memory leak

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CERT-FI reports :

Five vulnerabilities have been found in the BGP, OSPF, and OSPFv3 components of Quagga. The vulnerabilities allow an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified packets to an affected server. Routing messages are typically accepted from the routing peers. Exploiting these vulnerabilities may require an established routing session (BGP peering or OSPF/OSPFv3 adjacency) to the router.

The vulnerability CVE-2011-3327 is related to the extended communities handling in BGP messages. Receiving a malformed BGP update can result in a buffer overflow and disruption of IPv4 routing.

The vulnerability CVE-2011-3326 results from the handling of LSA (Link State Advertisement) states in the OSPF service. Receiving a modified Link State Update message with malicious state information can result in denial of service in IPv4 routing.

The vulnerability CVE-2011-3325 is a denial of service vulnerability related to Hello message handling by the OSPF service. As Hello messages are used to initiate adjacencies, exploiting the vulnerability may be feasible from the same broadcast domain without an established adjacency. A malformed packet may result in denial of service in IPv4 routing.

The vulnerabilities CVE-2011-3324 and CVE-2011-3323 are related to the IPv6 routing protocol (OSPFv3) implemented in ospf6d daemon. Receiving modified Database Description and Link State Update messages, respectively, can result in denial of service in IPv6 routing.

Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered several vulnerabilities in Quagga, an Internet routing daemon :

  - CVE-2011-3323     A stack-based buffer overflow while decoding Link State     Update packets with a malformed Inter Area Prefix LSA     can cause the ospf6d process to crash or (potentially)     execute arbitrary code.

  - CVE-2011-3324     The ospf6d process can crash while processing a Database     Description packet with a crafted     Link-State-Advertisement.

  - CVE-2011-3325     The ospfd process can crash while processing a crafted     Hello packet.

  - CVE-2011-3326     The ospfd process crashes while processing     Link-State-Advertisements of a type not known to Quagga.

  - CVE-2011-3327     A heap-based buffer overflow while processing BGP UPDATE     messages containing an Extended Communities path     attribute can cause the bgpd process to crash or     (potentially) execute arbitrary code.

The OSPF-related vulnerabilities require that potential attackers send packets to a vulnerable Quagga router; the packets are not distributed over OSPF. In contrast, the BGP UPDATE messages could be propagated by some routers.

ID	Name	Product	Family	Severity
217424	Linux Distros Unpatched Vulnerability : CVE-2011-3324	Nessus	Misc.	high
80751	Oracle Solaris Third-Party Patch Update : quagga (multiple_denial_of_service_vulnerabilities4)	Nessus	Solaris Local Security Checks	medium
76007	openSUSE Security Update : quagga (openSUSE-SU-2011:1155-1)	Nessus	SuSE Local Security Checks	high
75723	openSUSE Security Update : quagga (openSUSE-SU-2011:1155-1)	Nessus	SuSE Local Security Checks	high
68618	Oracle Linux 6 : quagga (ELSA-2012-1259)	Nessus	Oracle Linux Local Security Checks	high
68617	Oracle Linux 5 : quagga (ELSA-2012-1258)	Nessus	Oracle Linux Local Security Checks	high
62095	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	high
62094	Scientific Linux Security Update : quagga on SL5.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	high
62081	CentOS 6 : quagga (CESA-2012:1259)	Nessus	CentOS Local Security Checks	high
62070	RHEL 6 : quagga (RHSA-2012:1259)	Nessus	Red Hat Local Security Checks	high
62069	RHEL 5 : quagga (RHSA-2012:1258)	Nessus	Red Hat Local Security Checks	high
62066	CentOS 5 : quagga (CESA-2012:1258)	Nessus	CentOS Local Security Checks	high
59790	Quagga < 0.99.19 Multiple Vulnerabilities	Nessus	Misc.	high
58081	GLSA-201202-02 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57250	SuSE 10 Security Update : quagga (ZYPP Patch Number 7768)	Nessus	SuSE Local Security Checks	high
57132	SuSE 11.1 Security Update : quagga (SAT Patch Number 5169)	Nessus	SuSE Local Security Checks	high
57131	SuSE 11.1 Security Update : quagga (SAT Patch Number 5169)	Nessus	SuSE Local Security Checks	high
56853	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : quagga vulnerabilities (USN-1261-1)	Nessus	Ubuntu Local Security Checks	high
56615	SuSE 10 Security Update : quagga (ZYPP Patch Number 7767)	Nessus	SuSE Local Security Checks	high
56540	Fedora 15 : quagga-0.99.20-2.fc15 (2011-13504)	Nessus	Fedora Local Security Checks	high
56539	Fedora 14 : quagga-0.99.20-2.fc14 (2011-13499)	Nessus	Fedora Local Security Checks	high
56538	Fedora 16 : quagga-0.99.20-2.fc16 (2011-13492)	Nessus	Fedora Local Security Checks	high
56399	FreeBSD : quagga -- multiple vulnerabilities (ab9be2c8-ef91-11e0-ad5a-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	high
56394	Debian DSA-2316-1 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2011-3324

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high