The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).

The remote Solaris system is missing necessary patches to address security updates :

  - ImageMagick 6.7.5-7 and earlier allows remote attackers     to cause a denial of service (infinite loop and hang)     via a crafted image whose IFD contains IOP tags that all     reference the beginning of the IDF. (CVE-2012-0248)

  - Buffer overflow in the ospf_ls_upd_list_lsa function in     ospf_packet.c in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (assertion failure and daemon exit)     via a Link State Update (aka LS Update) packet that is     smaller than the length specified in its header.
    (CVE-2012-0249)

  - Buffer overflow in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (daemon crash) via a Link State     Update (aka LS Update) packet containing a network-LSA     link-state advertisement for which the data-structure     length is smaller than the value in the Length header     field. (CVE-2012-0250)

  - The BGP implementation in bgpd in Quagga before     0.99.20.1 does not properly use message buffers for OPEN     messages, which allows remote attackers to cause a     denial of service (assertion failure and daemon exit)     via a message associated with a malformed Four-octet AS     Number Capability (aka AS4 capability). (CVE-2012-0255)

  - The bgp_capability_orf function in bgpd in Quagga     0.99.20.1 and earlier allows remote attackers to cause a     denial of service (assertion failure and daemon exit) by     leveraging a BGP peering relationship and sending a     malformed Outbound Route Filtering (ORF) capability TLV     in an OPEN message. (CVE-2012-1820)

The remote host is affected by the vulnerability described in GLSA-201310-08 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause arbitrary code execution or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1259 advisory.

    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250
    - fix CVE-2012-1820
    - Resolves: #684751 - CVE-2010-1674 CVE-2010-1675 quagga various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of quagga fixes multiple security flaws that could have caused a Denial of Service via specially crafted packets.
(CVE-2012-1820 / CVE-2012-0249 / CVE-2012-0250 / CVE-2012-0255)

Additionally, issues with service owned directories in combination with logrotate were fixed.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol.
The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamaki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory.

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

  - quagga (bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message     (CVE-2012-0255)

  - quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV     (VU#962587) (CVE-2012-1820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the installation of Quagga listening on the remote host is affected by multiple vulnerabilities :

  - A buffer overflow vulnerability exists in OSPFD can be     triggered by a specially crafted Link Status Update     message that is smaller than the length specified in     its header, leading to denial of service.
    (CVE-2012-0249)

  - A buffer overflow vulnerability in exists OSPFD can be     triggered by a specially crafted Link Status Update     message containing a network-LSA link-state     advertisement for which the data-structure length is     smaller than the value in the Length header field,     leading to denial of service. (CVE-2012-0250)

  - A denial of service vulnerability exists in BGPD that     can be triggered by a specially crafted OPEN message     with a malformed four-octet AS Number Capability.
    (CVE-2012-0250)

It was discovered that Quagga incorrectly handled Link State Update messages with invalid lengths. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service.
(CVE-2012-0249, CVE-2012-0250)

It was discovered that Quagga incorrectly handled messages with a malformed Four-octet AS Number Capability. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service.
(CVE-2012-0255).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Quagga, a routing daemon.

  - CVE-2012-0249     A buffer overflow in the ospf_ls_upd_list_lsa function     in the OSPFv2 implementation allows remote attackers to     cause a denial of service (assertion failure and daemon     exit) via a Link State Update (aka LS Update) packet     that is smaller than the length specified in its header.

  - CVE-2012-0250     A buffer overflow in the OSPFv2 implementation allows     remote attackers to cause a denial of service (daemon     crash) via a Link State Update (aka LS Update) packet     containing a network-LSA link-state advertisement for     which the data-structure length is smaller than the     value in the Length header field.

  - CVE-2012-0255     The BGP implementation does not properly use message     buffers for OPEN messages, which allows remote attackers     impersonating a configured BGP peer to cause a denial of     service (assertion failure and daemon exit) via a     message associated with a malformed AS4 capability.

This security update upgrades the quagga package to the most recent upstream release. This release includes other corrections, such as hardening against unknown BGP path attributes.

fixes CVEs, updates to latest upstream quagga-0.99.20.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CERT reports :

The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon aborts due to an assert) with a malformed OSPF LS-Update message.

The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon crash) with a malformed OSPF Network- LSA message.

The bgpd implementation of BGP in Quagga allows remote attackers to cause a denial of service (daemon aborts due to an assert) via BGP Open message with an invalid AS4 capability.

ID	Name	Product	Family	Severity
80752	Oracle Solaris Third-Party Patch Update : quagga (cve_2012_1820_denial_of)	Nessus	Solaris Local Security Checks	medium
70381	GLSA-201310-08 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
68618	Oracle Linux 6 : quagga (ELSA-2012-1259)	Nessus	Oracle Linux Local Security Checks	high
64222	SuSE 11.1 Security Update : quagga (SAT Patch Number 6241)	Nessus	SuSE Local Security Checks	medium
62095	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	high
62081	CentOS 6 : quagga (CESA-2012:1259)	Nessus	CentOS Local Security Checks	high
62070	RHEL 6 : quagga (RHSA-2012:1259)	Nessus	Red Hat Local Security Checks	high
59791	Quagga < 0.99.20.1 Multiple Vulnerabilities	Nessus	Misc.	medium
59393	SuSE 10 Security Update : quagga (ZYPP Patch Number 8108)	Nessus	SuSE Local Security Checks	medium
59107	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : quagga vulnerabilities (USN-1441-1)	Nessus	Ubuntu Local Security Checks	medium
58883	Debian DSA-2459-2 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58822	Fedora 15 : quagga-0.99.20.1-1.fc15 (2012-5436)	Nessus	Fedora Local Security Checks	medium
58819	Fedora 16 : quagga-0.99.20.1-1.fc16 (2012-5411)	Nessus	Fedora Local Security Checks	medium
58805	Fedora 17 : quagga-0.99.20.1-1.fc17 (2012-5352)	Nessus	Fedora Local Security Checks	medium
58471	FreeBSD : quagga -- multiple vulnerabilities (42a2c82a-75b9-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-0255

high

Tenable Plugins

medium

medium

high

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium