CentOS 3 / 4 : quagga (CESA-2006:0525)

medium Nessus Plugin ID 21904

Synopsis

The remote CentOS host is missing one or more security updates.

Description

Updated quagga packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga manages the TCP/IP based routing protocol. It takes a multi-server and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect Quagga configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an attacker is able to connect to the Quagga telnet interface, it is possible to cause Quagga to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain backported patches that correct these issues.

Solution

Update the affected quagga packages.

Plugin Details

Severity: Medium

ID: 21904

File Name: centos_RHSA-2006-0525.nasl

Version: 1.22

Type: local

Agent: unix

Family: CentOS Local Security Checks

Published: 7/3/2006

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:centos:centos:quagga, p-cpe:/a:centos:centos:quagga-contrib, p-cpe:/a:centos:centos:quagga-devel, cpe:/o:centos:centos:3, cpe:/o:centos:centos:4

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/1/2006

Vulnerability Publication Date: 5/5/2006

Reference Information

CVE: CVE-2006-2223, CVE-2006-2224, CVE-2006-2276

BID: 17808

RHSA: 2006:0525

Detections

Analytics