The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.

Fix for CVE-2013-6051

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the installation of Quagga's BGP daemon listening on the remote host is affected by a denial of service vulnerability.  This issue exists due to a failure to properly initialize the packet's total size variable in the 'bgp_attr.c' source file.  Normal, valid BGP update messages can trigger this issue.

Multiple vulnerabilities were discovered in Quagga, a BGP/OSPF/RIP routing daemon :

  - CVE-2013-2236     A buffer overflow was found in the OSPF API-server     (exporting the LSDB and allowing announcement of     Opaque-LSAs).

  - CVE-2013-6051     bgpd could be crashed through BGP updates. This only     affects Wheezy/stable.

ID	Name	Product	Family	Severity
72297	Amazon Linux AMI : quagga (ALAS-2014-279)	Nessus	Amazon Linux Local Security Checks	medium
71638	Fedora 18 : quagga-0.99.21-6.fc18 (2013-23504)	Nessus	Fedora Local Security Checks	medium
71536	Quagga 0.99.21 bgp_attr.c BGP Update DoS	Nessus	Misc.	medium
71097	Debian DSA-2803-1 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6051

high

Tenable Plugins

medium

medium

medium

medium