This update for quagga fixes the following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A denial of service flaw was found in the way the bgpd     daemon in Quagga handled the processing of large BGP     update messages. A remote, previously trusted attacker     could potentially use this flaw to cause bgpd to     terminate existing BGP sessions, thereby leading to     denial of service.(CVE-2017-16227)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following security issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the security following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rebase to version 1.2.2, solves CVE-2017-16227, solves error produced by install script

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following issues :

  - CVE-2017-16227: Fixed bgpd DoS via specially crafted BGP     UPDATE messages (boo#1065641)

  - CVE-2018-5378: Fixed bgpd bounds check issue via     attribute length (Quagga-2018-0543,boo#1079798)

  - CVE-2018-5379: Fixed bgpd double free when processing     UPDATE message (Quagga-2018-1114,boo#1079799)

  - CVE-2018-5380: Fixed bgpd code-to-string conversion     tables overrun (Quagga-2018-1550,boo#1079800)

  - CVE-2018-5381: Fixed bgpd infinite loop on certain     invalid OPEN messages (Quagga-2018-1975,boo#1079801)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - quagga: Buffer Overflow in IPv6 RA handling (CVE-2016-1245)

  - quagga: VPNv4 NLRI parser memcpys to stack on unchecked length (CVE-2016-2342)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping     data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash)     via a large BGP packet. (CVE-2016-4049)

  - The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a     denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths     counts certain bytes twice and consequently constructs an invalid message. (CVE-2017-16227)

  - Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement     (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of     the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally     MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered     more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not     explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-     originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker     to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a     'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers within the routing domain, creating a denial of     service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga     and downstream implementations (SUSE, openSUSE, and Red Hat packages). (CVE-2017-3224)

  - All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet     'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons     are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this     vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local     access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound,     so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate     unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by     the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing     (FRR) Protocol Suite 2017-01-10. (CVE-2017-5495)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion     tables used for debug by 1 pointer value, based on input. (CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of Capabilities in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial     of service. (CVE-2018-5381)

  - An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file     allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to     root upon package installation or update. (CVE-2021-44038)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

For Debian 7 'Wheezy', these problems have been fixed in version quagga_0.99.22.4-1+wheezy3+deb7u2.

We recommend that you upgrade your quagga packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker could possibly use this issue to cause Quagga to crash, resulting in a denial of service.
(CVE-2017-16227)

Quentin Young discovered that Quagga incorrectly handled memory in the telnet vty CLI. An attacker able to connect to the telnet interface could possibly use this issue to cause Quagga to consume memory, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-5495).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to     crash or potentially execute arbitrary code (CVE-2018-5379)

  - The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a     denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths     counts certain bytes twice and consequently constructs an invalid message. (CVE-2017-16227)

  - Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement     (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of     the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally     MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered     more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not     explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-     originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker     to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a     'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers within the routing domain, creating a denial of     service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga     and downstream implementations (SUSE, openSUSE, and Red Hat packages). (CVE-2017-3224)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion     tables used for debug by 1 pointer value, based on input. (CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of Capabilities in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial     of service. (CVE-2018-5381)

  - An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file     allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to     root upon package installation or update. (CVE-2021-44038)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
106868	SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)	Nessus	SuSE Local Security Checks	2/16/2018	12/5/2022	critical
104926	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2017-1308)	Nessus	Huawei Local Security Checks	12/1/2017	1/6/2021	high
106866	SUSE SLES12 Security Update : quagga (SUSE-SU-2018:0455-1)	Nessus	SuSE Local Security Checks	2/16/2018	12/5/2022	critical
106867	SUSE SLES12 Security Update : quagga (SUSE-SU-2018:0456-1)	Nessus	SuSE Local Security Checks	2/16/2018	12/5/2022	critical
105914	Fedora 27 : quagga (2017-7d25605e98)	Nessus	Fedora Local Security Checks	1/15/2018	1/6/2021	high
104925	EulerOS 2.0 SP1 : quagga (EulerOS-SA-2017-1307)	Nessus	Huawei Local Security Checks	12/1/2017	1/6/2021	high
106895	openSUSE Security Update : quagga (openSUSE-2018-177)	Nessus	SuSE Local Security Checks	2/20/2018	12/5/2022	critical
195538	RHEL 7 : quagga (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
104259	Debian DSA-4011-1 : quagga - security update	Nessus	Debian Local Security Checks	10/31/2017	1/4/2021	high
104301	Debian DLA-1152-1 : quagga security update	Nessus	Debian Local Security Checks	11/1/2017	1/11/2021	high
104323	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3471-1)	Nessus	Ubuntu Local Security Checks	11/1/2017	10/20/2023	high
104831	Fedora 26 : quagga (2017-df3032c978)	Nessus	Fedora Local Security Checks	11/29/2017	1/6/2021	high
195543	RHEL 6 : quagga (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

high

high

critical

critical

high

high

high

high

critical