The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.

SunOS 5.10_x86: zebra ripd quagga patch.
Date this patch was last updated by Sun : Jul/15/14

SunOS 5.10: zebra ripd quagga patch.
Date this patch was last updated by Sun : Jul/15/14

This update of quagga fixes two security issues :

  - specially crafted OSPF packets could have caused the     routing table to be erased. (bnc#822572).
    (CVE-2013-0149)

  - local network stack overflow (bnc#828117).
    (CVE-2013-2236)

The remote Cisco NX-OS device is affected by a vulnerability involving the Open Shortest Path First (OSPF) routing protocol Link State Advertisement (LSA) database. By injecting specially crafted OSPF packets, an unauthenticated attacker could manipulate or disrupt the flow of network traffic through the device.

The remote Cisco IOS XE device is affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database. A remote, unauthenticated attacker can exploit this vulnerability, via specially crafted OSPF packets, to manipulate or disrupt the flow of network traffic through the device.

The remote Cisco IOS device is affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database.  This vulnerability could be exploited by injecting specially crafted OSPF packets.  Successful exploitation could allow an unauthenticated attacker to manipulate or disrupt the flow of network traffic through the device.

The remote Cisco ASA device is affected by a vulnerability involving the Open Shortest Path First (OSPF) Routing Protocol Link State Advertisement (LSA) database.  This vulnerability could be exploited by injecting specially crafted OSPF packets.  Successful exploitation could allow an unauthenticated attacker to manipulate or disrupt the flow of network traffic through the device.

According to its self-reported version number, the remote Juniper Junos device has a flaw in its OSPF implementation. A rogue router in the same autonomous system (AS) could exploit this to control the routing tables of all other routers in the AS.

Note that this issue does not affect device with one of the following configurations :

  - Interfaces not configured for OSPF

  - Passive OSPF interfaces

  - OSPF configurations that use MD5 authentication

  - OSPF interfaces that block external parties from sending     OSPF link-state update packets

ID	Name	Product	Family	Severity
107948	Solaris 10 (x86) : 126207-11	Nessus	Solaris Local Security Checks	medium
107448	Solaris 10 (sparc) : 126206-11	Nessus	Solaris Local Security Checks	medium
70020	SuSE 11.2 / 11.3 Security Update : quagga (SAT Patch Numbers 8234 / 8235)	Nessus	SuSE Local Security Checks	medium
69379	OSPF LSA Manipulation Vulnerability in Cisco NX-OS (cisco-sa-20130801-lsaospf)	Nessus	CISCO	medium
69378	OSPF LSA Manipulation Vulnerability in Cisco IOS XE (cisco-sa-20130801-lsaospf)	Nessus	CISCO	medium
69377	OSPF LSA Manipulation Vulnerability in Cisco IOS (cisco-sa-20130801-lsaospf)	Nessus	CISCO	medium
69376	OSPF LSA Manipulation Vulnerability in Cisco ASA (cisco-sa-20130801-lsaospf)	Nessus	CISCO	medium
69194	Juniper Junos OSPF Protocol Vulnerability (JSA10582)	Nessus	Junos Local Security Checks	high

Detections

Analytics

CVE-2013-0149

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high