Zebra 0.93b and earlier, and quagga before 0.95, allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.

A remote attacker could cause zebra/quagga to crash by sending a malformed telnet command to their management port.

Herbert Xu discovered that iproute can accept spoofed messages sent via the kernel netlink interface by other users on the local machine.
This could lead to a local Denial of Service attack.

The updated packages have been patched to prevent this problem.

Two vulnerabilities were discovered in zebra, an IP routing daemon :

  - CAN-2003-0795 - a bug in the telnet CLI could allow a     remote attacker to cause a zebra process to crash,     resulting in a denial of service.
  - CAN-2003-0858 - netlink messages sent by other users     (rather than the kernel) would be accepted, leading to a     denial of service.

Updated Quagga packages that close a locally-exploitable denial of service vulnerability are now available.

Quagga is an open source implementation of TCP/IP routing software.

Herbert Xu reported that Quagga can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0858 to this issue.

Users of Quagga should upgrade to these erratum packages, which contain a patch that checks that netlink messages actually came from the kernel. This erratum also includes quagga-devel and quagga-contrib packages which were not originally shipped with Red Hat Enterprise Linux 3.

Updated zebra packages that close a locally-exploitable and a remotely-exploitable denial of service vulnerability are now available.

Zebra an open source implementation of TCP/IP routing software.

Jonny Robertson reported that Zebra can be remotely crashed if a Zebra password has been enabled and a remote attacker can connect to the Zebra telnet management port. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0795 to this issue.

Herbert Xu reported that Zebra can accept spoofed messages sent on the kernel netlink interface by other users on the local machine. This could lead to a local denial of service attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0858 to this issue.

Users of Zebra should upgrade to these erratum packages, which contain a patch preventing Zebra from crashing when it receives a telnet option delimiter without any option data, and a patch that checks that netlink messages actually came from the kernel.

ID	Name	Product	Family	Severity
38031	FreeBSD : zebra/quagga denial of service vulnerability (cad045c0-81a5-11d8-9645-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	low
15956	Mandrake Linux Security Advisory : iproute2 (MDKSA-2004:148)	Nessus	Mandriva Local Security Checks	medium
15252	Debian DSA-415-1 : zebra - denial of service	Nessus	Debian Local Security Checks	medium
12431	RHEL 3 : quagga (RHSA-2003:315)	Nessus	Red Hat Local Security Checks	low
12427	RHEL 2.1 : zebra (RHSA-2003:305)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2003-0858

medium

Tenable Plugins

low

medium

medium

low

medium