All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.

The remote NewStart CGSL host, running version MAIN 4.05, has quagga packages installed that are affected by multiple vulnerabilities:

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash. (CVE-2017-5495)

  - A stack-based buffer overflow flaw was found in the way     Quagga handled IPv6 router advertisement messages. A     remote attacker could use this flaw to crash the zebra     daemon resulting in denial of service. (CVE-2016-1245)

  - A denial of service flaw was found in the Quagga BGP     routing daemon (bgpd). Under certain circumstances, a     remote attacker could send a crafted packet to crash the     bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

  - A stack-based buffer overflow flaw was found in the way     the Quagga BGP routing daemon (bgpd) handled Labeled-VPN     SAFI routes data. A remote attacker could use this flaw     to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-2342)

  - A stack-based buffer overflow flaw was found in the way     the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this     flaw to crash the ospfd daemon resulting in denial of     service. (CVE-2013-2236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A double-free vulnerability was found in Quagga. A BGP     peer could send a specially crafted UPDATE message     which would cause allocated blocks of memory to be     free()d more than once, potentially leading to a crash     or other issues.(CVE-2018-5379)

  - All versions of Quagga, 0.93 through 1.1.0, are     vulnerable to an unbounded memory allocation in the     telnet 'vty' CLI, leading to a Denial-of-Service of     Quagga daemons, or even the entire host. When Quagga     daemons are configured with their telnet CLI enabled,     anyone who can connect to the TCP ports can trigger     this vulnerability, prior to authentication. Most     distributions restrict the Quagga telnet interface to     local access only by default. The Quagga telnet     interface 'vty' input buffer grows automatically,     without bound, so long as a newline is not entered.
    This allows an attacker to cause the Quagga daemon to     allocate unbounded memory by sending very long strings     without a newline. Eventually the daemon is terminated     by the system, or the system itself runs out of     memory.(CVE-2017-5495)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following security issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.
(CVE-2017-16227)

Quentin Young discovered that Quagga incorrectly handled memory in the telnet vty CLI. An attacker able to connect to the telnet interface could possibly use this issue to cause Quagga to consume memory, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-5495).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides Quagga 1.1.1, which brings several fixes and enhancements. Security issues fixed :

  - CVE-2017-5495: Telnet 'vty' interface DoS due to     unbounded memory allocation. (bsc#1021669)

  - CVE-2016-1245: Stack overrun in IPv6 RA receive code.
    (bsc#1005258) Bug fixes :

  - Do not enable zebra's TCP interface (port 2600) to use     default UNIX socket for communication between the     daemons. (fate#323170) Between 0.99.22.1 and 1.1.1 the     following improvements have been implemented :

  - Changed the default of 'link-detect' state, controlling     whether zebra will respond to link-state events and     consider an interface to be down when link is down. To     retain the current behavior save your config before     updating, otherwise remove the 'link-detect' flag from     your config prior to updating. There is also a new     global 'default link-detect (on|off)' flag to configure     the global default.

  - Greatly improved nexthop resolution for recursive     routes.

  - Event driven nexthop resolution for BGP.

  - Route tags support.

  - Transport of TE related metrics over OSPF, IS-IS.

  - IPv6 Multipath for zebra and BGP.

  - Multicast RIB support has been extended. It still is     IPv4 only.

  - RIP for IPv4 now supports equal-cost multipath (ECMP).

  - route-maps have a new action 'set ipv6 next-hop     peer-address'.

  - route-maps have a new action 'set as-path prepend     last-as'.

  - 'next-hop-self all' to override nexthop on iBGP route     reflector setups.

  - New pimd daemon provides IPv4 PIM-SSM multicast routing.

  - IPv6 address management has been improved regarding     tentative addresses. This is visible in that a freshly     configured address will not immediately be marked as     usable.

  - Recursive route support has been overhauled. Scripts     parsing 'show ip route' output may need adaptation.

  - A large amount of changes has been merged for ospf6d.
    Careful evaluation prior to deployment is recommended.

  - Multiprotocol peerings over IPv6 now try to find a more     appropriate IPv4 nexthop by looking at the interface.

  - Relaxed bestpath criteria for multipath and improved     display of multipath routes in 'show ip bgp'. Scripts     parsing this output may need to be updated.

  - Support for iBGP TTL security.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga to version 1.1.1 fixes the following issues :

This security issue was fixed :

  - CVE-2017-5495: Quagga was vulnerable to an unbounded     memory allocation in the telnet 'vty' CLI, leading to a     Denial-of-Service of Quagga daemons, or even the entire     host. When Quagga daemons are configured with their     telnet CLI enabled, anyone who can connect to the TCP     ports can trigger this vulnerability, prior to     authentication (bsc#1021669).

These non-security issues were fixed :

  - Disabled passwords in default zebra.conf config file,     causing to disable vty telnet interface by default. The     vty interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password (boo#1021669).

  - Changed owner of /etc/quagga to quagga:quagga to permit     to manage quagga via vty interface.

  - Added quagga.log and create and su statemets to     logrotate config, changed default zebra log file name     from quagga.log to zebra.log.

  - Added libfpm_pb0 and libquagga_pb0 shared library     sub-packages, adjusted libzebra0 sub-package name to     libzebra1.

  - Do not enable zebra's tcp interface (port 2600) to use     default unix socket for communication between the     daemons 

A digest of the other changes by the version upgrade :

  - isisd: Fix size of malloc

  - isisd: check for the existance of the correct list

  - ospf6d: fix off-by-one on display of spf reasons

  - ospf6d: don't access nexthops out of bounds

  - bgpd: fix off-by-one in attribute flags handling

  - bgpd: Fix buffer overflow error in bgp_dump_routes_func

Please http://mirror.easyname.at/nongnu/quagga/quagga-1.1.1.changelog.txt and the changelog for a complete list of changes.

This update for quagga fixes the following issues :

This security issue was fixed :

  - CVE-2017-5495: Quagga was vulnerable to an unbounded     memory allocation in the telnet 'vty' CLI, leading to a     Denial-of-Service of Quagga daemons, or even the entire     host. When Quagga daemons are configured with their     telnet CLI enabled, anyone who can connect to the TCP     ports can trigger this vulnerability, prior to     authentication (bsc#1021669).

These non-security issues were fixed :

  - Disabled passwords in default zebra.conf config file,     causing to disable vty telnet interface by default. The     vty interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password (boo#1021669).

  - Changed owner of /etc/quagga to quagga:quagga to permit     to manage quagga via vty interface.

  - Added quagga.log and create and su statemets to     logrotate config, changed default zebra log file name     from quagga.log to zebra.log.

According to the version of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash.(CVE-2017-5495)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A stack-based buffer overflow flaw was found in the way     Quagga handled IPv6 router advertisement messages. A     remote attacker could use this flaw to crash the zebra     daemon resulting in denial of service. (CVE-2016-1245)

  - A stack-based buffer overflow flaw was found in the way     the Quagga BGP routing daemon (bgpd) handled Labeled-VPN     SAFI routes data. A remote attacker could use this flaw     to crash the bgpd daemon resulting in denial of service.
    (CVE-2016-2342)

  - A denial of service flaw was found in the Quagga BGP     routing daemon (bgpd). Under certain circumstances, a     remote attacker could send a crafted packet to crash the     bgpd daemon resulting in denial of service.
    (CVE-2016-4049)

  - A denial of service flaw affecting various daemons in     Quagga was found. A remote attacker could use this flaw     to cause the various Quagga daemons, which expose their     telnet interface, to crash. (CVE-2017-5495)

  - A stack-based buffer overflow flaw was found in the way     the Quagga OSPFD daemon handled LSA (link-state     advertisement) packets. A remote attacker could use this     flaw to crash the ospfd daemon resulting in denial of     service. (CVE-2013-2236)

From Red Hat Security Advisory 2017:0794 :

An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

An update for quagga is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es) :

* A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245)

* A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342)

* A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049)

* A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash.
(CVE-2017-5495)

* A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.

Fix for CVE-2017-5495

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127329	NewStart CGSL MAIN 4.05 : quagga Multiple Vulnerabilities (NS-SA-2019-0101)	Nessus	NewStart CGSL Local Security Checks	critical
108469	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2018-1065)	Nessus	Huawei Local Security Checks	high
106868	SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)	Nessus	SuSE Local Security Checks	critical
106866	SUSE SLES12 Security Update : quagga (SUSE-SU-2018:0455-1)	Nessus	SuSE Local Security Checks	critical
104323	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3471-1)	Nessus	Ubuntu Local Security Checks	high
102841	SUSE SLES12 Security Update : quagga (SUSE-SU-2017:2294-1)	Nessus	SuSE Local Security Checks	critical
100037	openSUSE Security Update : quagga (openSUSE-2017-551)	Nessus	SuSE Local Security Checks	high
100035	openSUSE Security Update : quagga (openSUSE-2017-547)	Nessus	SuSE Local Security Checks	high
99903	EulerOS 2.0 SP1 : quagga (EulerOS-SA-2017-1058)	Nessus	Huawei Local Security Checks	high
99223	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20170321)	Nessus	Scientific Linux Local Security Checks	critical
99073	Oracle Linux 6 : quagga (ELSA-2017-0794)	Nessus	Oracle Linux Local Security Checks	critical
97961	CentOS 6 : quagga (CESA-2017:0794)	Nessus	CentOS Local Security Checks	critical
97885	RHEL 6 : quagga (RHSA-2017:0794)	Nessus	Red Hat Local Security Checks	critical
97429	Fedora 24 : quagga (2017-ba9c6a3634)	Nessus	Fedora Local Security Checks	high
97176	Fedora 25 : quagga (2017-b89a945e9d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-5495

high

Tenable Plugins

critical

high

critical

critical

high

critical

high

high

high

critical

critical

critical

critical

high

high