The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - quagga: Buffer Overflow in IPv6 RA handling (CVE-2016-1245)

  - quagga: VPNv4 NLRI parser memcpys to stack on unchecked length (CVE-2016-2342)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping     data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash)     via a large BGP packet. (CVE-2016-4049)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to     crash or potentially execute arbitrary code (CVE-2018-5379)

  - quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal     (CVE-2012-5521)

  - The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a     denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths     counts certain bytes twice and consequently constructs an invalid message. (CVE-2017-16227)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for quagga fixes the following issues :

  - CVE-2017-16227: Fixed bgpd DoS via specially crafted BGP     UPDATE messages (boo#1065641)

  - CVE-2018-5378: Fixed bgpd bounds check issue via     attribute length (Quagga-2018-0543,boo#1079798)

  - CVE-2018-5379: Fixed bgpd double free when processing     UPDATE message (Quagga-2018-1114,boo#1079799)

  - CVE-2018-5380: Fixed bgpd code-to-string conversion     tables overrun (Quagga-2018-1550,boo#1079800)

  - CVE-2018-5381: Fixed bgpd infinite loop on certain     invalid OPEN messages (Quagga-2018-1975,boo#1079801)

This update for quagga fixes the following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the security following issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for quagga fixes the following security issues :

  - The Quagga BGP daemon contained a bug in the AS_PATH     size calculation that could have been exploited to     facilitate a remote denial-of-service attack via     specially crafted BGP UPDATE messages. [CVE-2017-16227,     bsc#1065641]

  - The Quagga BGP daemon did not check whether data sent to     peers via NOTIFY had an invalid attribute length. It was     possible to exploit this issue and cause the bgpd     process to leak sensitive information over the network     to a configured peer. [CVE-2018-5378, bsc#1079798]

  - The Quagga BGP daemon used to double-free memory when     processing certain forms of UPDATE messages. This issue     could be exploited by sending an optional/transitive     UPDATE attribute that all conforming eBGP speakers     should pass along. Consequently, a single UPDATE message     could have affected many bgpd processes across a wide     area of a network. Through this vulnerability, attackers     could potentially have taken over control of affected     bgpd processes remotely. [CVE-2018-5379, bsc#1079799]

  - It was possible to overrun internal BGP code-to-string     conversion tables in the Quagga BGP daemon. Configured     peers could have exploited this issue and cause bgpd to     emit debug and warning messages into the logs that would     contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]

  - The Quagga BGP daemon could have entered an infinite     loop if sent an invalid OPEN message by a configured     peer. If this issue was exploited, then bgpd would cease     to respond to any other events. BGP sessions would have     been dropped and not be reestablished. The CLI interface     would have been unresponsive. The bgpd daemon would have     stayed in this state until restarted. [CVE-2018-5381,     bsc#1079801]

  - The Quagga daemon's telnet 'vty' CLI contains an     unbounded memory allocation bug that could be exploited     for a denial-of-service attack on the daemon. This issue     has been fixed. [CVE-2017-5495, bsc#1021669]

  - The telnet 'vty' CLI of the Quagga daemon is no longer     enabled by default, because the passwords in the default     'zebra.conf' config file are now disabled. The vty     interface is available via 'vtysh' utility using pam     authentication to permit management access for root     without password. [bsc#1021669]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rebase to version 1.2.2, solves CVE-2017-16227, solves error produced by install script

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A denial of service flaw was found in the way the bgpd     daemon in Quagga handled the processing of large BGP     update messages. A remote, previously trusted attacker     could potentially use this flaw to cause bgpd to     terminate existing BGP sessions, thereby leading to     denial of service.(CVE-2017-16227)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3471-1 advisory.

    Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE messages. A remote attacker     could possibly use this issue to cause Quagga to crash, resulting in a denial of service. (CVE-2017-16227)

    Quentin Young discovered that Quagga incorrectly handled memory in the telnet vty CLI. An attacker able to     connect to the telnet interface could possibly use this issue to cause Quagga to consume memory, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-5495)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

For Debian 7 'Wheezy', these problems have been fixed in version quagga_0.99.22.4-1+wheezy3+deb7u2.

We recommend that you upgrade your quagga packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.

ID	Name	Product	Family	Severity
199393	RHEL 7 : quagga (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199343	RHEL 6 : quagga (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
106895	openSUSE Security Update : quagga (openSUSE-2018-177)	Nessus	SuSE Local Security Checks	critical
106868	SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)	Nessus	SuSE Local Security Checks	critical
106867	SUSE SLES12 Security Update : quagga (SUSE-SU-2018:0456-1)	Nessus	SuSE Local Security Checks	critical
106866	SUSE SLES12 Security Update : quagga (SUSE-SU-2018:0455-1)	Nessus	SuSE Local Security Checks	critical
105914	Fedora 27 : quagga (2017-7d25605e98)	Nessus	Fedora Local Security Checks	high
104926	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2017-1308)	Nessus	Huawei Local Security Checks	high
104925	EulerOS 2.0 SP1 : quagga (EulerOS-SA-2017-1307)	Nessus	Huawei Local Security Checks	high
104831	Fedora 26 : quagga (2017-df3032c978)	Nessus	Fedora Local Security Checks	high
104323	Ubuntu 14.04 LTS / 16.04 LTS : Quagga vulnerabilities (USN-3471-1)	Nessus	Ubuntu Local Security Checks	high
104301	Debian DLA-1152-1 : quagga security update	Nessus	Debian Local Security Checks	high
104259	Debian DSA-4011-1 : quagga - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16227

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high