RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.

According to its self-reported version number, the installation of Quagga listening on the remote host is affected by multiple vulnerabilities :

  - An information disclosure vulnerability in RIPD can be     triggered by a REQUEST packet, such as SEND UPDATE, on     hosts that disable RIPv1 or require plaintext or MD5     authentication. (CVE-2006-2223)

  - An authentication bypass vulnerability in RIPD may allow     unauthenticated, remote attackers to modify routing     state via RIPv1 RESPONSE packets. (CVE-2006-2224)

  - A denial of service vulnerability in Zebra can be     triggered by a certain BGP command. (CVE-2006-2276)

It was possible to bypass RIPv2 authentication requirements by using RIPv1. Since RIPv1 doesn't support authentication at all this update introduces an option to switch off RIPv1 (CVE-2006-2223, CVE-2006-2224).

Konstantin Gavrilenko discovered several vulnerabilities in quagga, the BGP/OSPF/RIP routing daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2223     Remote attackers may obtain sensitive information via     RIPv1 REQUEST packets even if the quagga has been     configured to use MD5 authentication.

  - CVE-2006-2224     Remote attackers could inject arbitrary routes using the     RIPv1 RESPONSE packet even if the quagga has been     configured to use MD5 authentication.

  - CVE-2006-2276     Fredrik Widell discovered that local users can cause a     denial of service in a certain sh ip bgp command entered     in the telnet interface.

Updated quagga packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga manages the TCP/IP based routing protocol. It takes a multi-server and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect Quagga configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an attacker is able to connect to the Quagga telnet interface, it is possible to cause Quagga to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain backported patches that correct these issues.

Updated zebra packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU Zebra is a free software that manages TCP/IP based routing protocol.

An information disclosure flaw was found in the way GNU Zebra interprets RIP REQUEST packets. RIPd in GNU Zebra will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way GNU Zebra interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect GNU Zebra configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in GNU Zebra's telnet interface. If an attacker is able to connect to the GNU Zebra telnet interface, it is possible to cause GNU Zebra to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of GNU Zebra should upgrade to these updated packages, which contain backported patches that correct these issues.

The remote host is affected by the vulnerability described in GLSA-200605-15 (Quagga Routing Suite: Multiple vulnerabilities)

    Konstantin V. Gavrilenko discovered two flaws in the Routing     Information Protocol (RIP) daemon that allow the processing of RIP v1     packets (carrying no authentication) even when the daemon is configured     to use MD5 authentication or, in another case, even if RIP v1 is     completely disabled. Additionally, Fredrik Widell reported that the     Border Gateway Protocol (BGP) daemon contains a flaw that makes it lock     up and use all available CPU when a specific command is issued from the     telnet interface.
  Impact :

    By sending RIP v1 response packets, an unauthenticated attacker     can alter the routing table of a router running Quagga's RIP daemon and     disclose routing information. Additionally, it is possible to lock up     the BGP daemon from the telnet interface.
  Workaround :

    There is no known workaround at this time.

Paul Jakma discovered that Quagga's ripd daemon did not properly handle authentication of RIPv1 requests. If the RIPv1 protocol had been disabled, or authentication for RIPv2 had been enabled, ripd still replied to RIPv1 requests, which could lead to information disclosure. (CVE-2006-2223)

Paul Jakma also noticed that ripd accepted unauthenticated RIPv1 response packets if RIPv2 was configured to require authentication and both protocols were allowed. A remote attacker could exploit this to inject arbitrary routes. (CVE-2006-2224)

Fredrik Widell discovered that Quagga did not properly handle certain invalid 'sh ip bgp' commands. By sending special commands to Quagga, a remote attacker with telnet access to the Quagga server could exploit this to trigger an endless loop in the daemon (Denial of Service).
(CVE-2006-2276).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
59793	Quagga < 0.98.6 / 0.99.4 Multiple Vulnerabilities	Nessus	Misc.	medium
27416	openSUSE 10 Security Update : quagga (quagga-1422)	Nessus	SuSE Local Security Checks	medium
22601	Debian DSA-1059-1 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	medium
21904	CentOS 3 / 4 : quagga (CESA-2006:0525)	Nessus	CentOS Local Security Checks	medium
21637	RHEL 2.1 : zebra (RHSA-2006:0533)	Nessus	Red Hat Local Security Checks	medium
21636	RHEL 3 / 4 : quagga (RHSA-2006:0525)	Nessus	Red Hat Local Security Checks	medium
21579	GLSA-200605-15 : Quagga Routing Suite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
21569	Ubuntu 5.04 / 5.10 : quagga vulnerabilities (USN-284-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2006-2224

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium