The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.

The remote Solaris system is missing necessary patches to address security updates :

  - ImageMagick 6.7.5-7 and earlier allows remote attackers     to cause a denial of service (infinite loop and hang)     via a crafted image whose IFD contains IOP tags that all     reference the beginning of the IDF. (CVE-2012-0248)

  - Buffer overflow in the ospf_ls_upd_list_lsa function in     ospf_packet.c in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (assertion failure and daemon exit)     via a Link State Update (aka LS Update) packet that is     smaller than the length specified in its header.
    (CVE-2012-0249)

  - Buffer overflow in the OSPFv2 implementation in ospfd in     Quagga before 0.99.20.1 allows remote attackers to cause     a denial of service (daemon crash) via a Link State     Update (aka LS Update) packet containing a network-LSA     link-state advertisement for which the data-structure     length is smaller than the value in the Length header     field. (CVE-2012-0250)

  - The BGP implementation in bgpd in Quagga before     0.99.20.1 does not properly use message buffers for OPEN     messages, which allows remote attackers to cause a     denial of service (assertion failure and daemon exit)     via a message associated with a malformed Four-octet AS     Number Capability (aka AS4 capability). (CVE-2012-0255)

  - The bgp_capability_orf function in bgpd in Quagga     0.99.20.1 and earlier allows remote attackers to cause a     denial of service (assertion failure and daemon exit) by     leveraging a BGP peering relationship and sending a     malformed Outbound Route Filtering (ORF) capability TLV     in an OPEN message. (CVE-2012-1820)

The remote host is affected by the vulnerability described in GLSA-201310-08 (Quagga: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Quagga. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause arbitrary code execution or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1259 advisory.

    - improve fix for CVE-2011-3325
    - fix CVE-2011-3323
    - fix CVE-2011-3324
    - fix CVE-2011-3325
    - fix CVE-2011-3326
    - fix CVE-2011-3327
    - fix CVE-2012-0255
    - fix CVE-2012-0249 and CVE-2012-0250
    - fix CVE-2012-1820
    - Resolves: #684751 - CVE-2010-1674 CVE-2010-1675 quagga various flaws

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated quagga package fixes security vulnerability :

The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message (CVE-2012-1820).

This update of quagga fixes multiple security flaws that could have caused a Denial of Service via specially crafted packets.
(CVE-2012-1820 / CVE-2012-0249 / CVE-2012-0250 / CVE-2012-0255)

Additionally, issues with service owned directories in combination with logrotate were fixed.

It was discovered that Quagga incorrectly handled certain malformed messages. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol.
The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially crafted BGP OPEN message.
(CVE-2012-0255, CVE-2012-1820)

Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamaki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820.

Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1259 advisory.

  - Quagga (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter     Area Prefix LSA (CVE-2011-3323)

  - Quagga (ospf6d): Denial of service by decoding malformed Database Description packet headers     (CVE-2011-3324)

  - Quagga (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2     header type (CVE-2011-3325)

  - Quagga (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (CVE-2011-3326)

  - Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes     (CVE-2011-3327)

  - quagga (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet     (CVE-2012-0249)

  - quagga (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA     structures (CVE-2012-0250)

  - quagga (bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message     (CVE-2012-0255)

  - quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV     (VU#962587) (CVE-2012-1820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the installation of Quagga's BGP daemon listening on the remote host is affected by a denial of service vulnerability. Unauthenticated attackers on the local network can trigger this issue by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering capability TLV in an OPEN message.

It was discovered that Quagga, a routing daemon, contains a vulnerability in processing the ORF capability in BGP OPEN messages. A malformed OPEN message from a previously configured BGP peer could cause bgpd to crash, causing a denial of service.

This update fixes CVE-2012-1820.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to the 0.99.21 which fixes various issues. In addition, this update fixes following CVE :

CVE-2012-1820: quagga (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CERT reports :

If a pre-configured BGP peer sends a specially crafted OPEN message with a malformed ORF capability TLV, Quagga bgpd process will erroneously try to consume extra bytes from the input packet buffer.
The process will detect a buffer overrun attempt before it happens and immediately terminate with an error message. All BGP sessions established by the attacked router will be closed and its BGP routing disrupted.

ID	Name	Product	Family	Severity
80752	Oracle Solaris Third-Party Patch Update : quagga (cve_2012_1820_denial_of)	Nessus	Solaris Local Security Checks	medium
70381	GLSA-201310-08 : Quagga: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69697	Amazon Linux AMI : quagga (ALAS-2012-90)	Nessus	Amazon Linux Local Security Checks	low
68618	Oracle Linux 6 : quagga (ELSA-2012-1259)	Nessus	Oracle Linux Local Security Checks	high
66134	Mandriva Linux Security Advisory : quagga (MDVSA-2013:122)	Nessus	Mandriva Local Security Checks	low
64222	SuSE 11.1 Security Update : quagga (SAT Patch Number 6241)	Nessus	SuSE Local Security Checks	medium
62512	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : quagga vulnerability (USN-1605-1)	Nessus	Ubuntu Local Security Checks	low
62095	Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	high
62081	CentOS 6 : quagga (CESA-2012:1259)	Nessus	CentOS Local Security Checks	high
62070	RHEL 6 : quagga (RHSA-2012:1259)	Nessus	Red Hat Local Security Checks	high
59792	Quagga < 0.99.21 BGP Denial of Service Vulnerability	Nessus	Misc.	low
59775	Debian DSA-2497-1 : quagga - denial of service	Nessus	Debian Local Security Checks	low
59579	Fedora 15 : quagga-0.99.20.1-2.fc15 (2012-9117)	Nessus	Fedora Local Security Checks	low
59578	Fedora 16 : quagga-0.99.21-2.fc16 (2012-9116)	Nessus	Fedora Local Security Checks	low
59577	Fedora 17 : quagga-0.99.21-2.fc17 (2012-9103)	Nessus	Fedora Local Security Checks	low
59393	SuSE 10 Security Update : quagga (ZYPP Patch Number 8108)	Nessus	SuSE Local Security Checks	medium
59380	FreeBSD : quagga -- BGP OPEN denial of service vulnerability (1e14d46f-af1f-11e1-b242-00215af774f0)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2012-1820

high

Tenable Plugins

medium

medium

low

high

low

medium

low

high

high

high

low

low

low

low

low

medium

low