From Red Hat Security Advisory 2007:0389 :

An updated quagga package that fixes a security bug is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga is a TCP/IP based routing software suite.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

All users of Quagga should upgrade to this updated package, which contains a backported patch to correct these issues.

According to its self-reported version number, the installation of Quagga's BGP daemon listening on the remote host is affected by a denial of service vulnerability. The issue can be triggered by a specially crafted UPDATE message from an explicitly configured BGP peer.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

It was discovered that Quagga did not correctly verify length information sent from configured peers. Remote malicious peers could send a specially crafted UPDATE message which would cause bgpd to abort, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to new upstream 0.99.7 should also fix the CVE-2007-1995 Quagga bgpd DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200705-05 (Quagga: Denial of Service)

    The Quagga development team reported a vulnerability in the BGP routing     deamon when processing NLRI attributes inside UPDATE messages.
  Impact :

    A malicious peer inside a BGP area could send a specially crafted     packet to a Quagga instance, possibly resulting in a crash of the     Quagga daemon.
  Workaround :

    There is no known workaround at this time.

Remote attackers could crash quagga via specially crafted 'UPDATE' messages (CVE-2007-1995).

An updated quagga package that fixes a security bug is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga is a TCP/IP based routing software suite.

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service (CVE-2007-1995).

All users of Quagga should upgrade to this updated package, which contains a backported patch to correct these issues.

Paul Jakma discovered that specially crafted UPDATE messages can trigger an out of boundary read that can result in a system crash of quagga, the BGP/OSPF/RIP routing daemon.

Remote attackers could crash quagga via specially crafted 'UPDATE' messages. (CVE-2007-1995)

ID	Name	Product	Family	Published	Updated	Severity
67506	Oracle Linux 3 / 4 / 5 : quagga (ELSA-2007-0389)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
59794	Quagga < 0.98.7 / 0.99.7 BGPD Denial of Service Vulnerability	Nessus	Misc.	6/29/2012	12/4/2019	medium
60193	Scientific Linux Security Update : quagga on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
28061	Ubuntu 6.06 LTS / 6.10 / 7.04 : quagga vulnerability (USN-461-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
27682	Fedora 7 : quagga-0.99.7-1.fc7 (2007-0838)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
25155	GLSA-200705-05 : Quagga: Denial of Service	Nessus	Gentoo Local Security Checks	5/3/2007	1/6/2021	medium
27417	openSUSE 10 Security Update : quagga (quagga-3233)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
25363	RHEL 3 / 4 / 5 : quagga (RHSA-2007:0389)	Nessus	Red Hat Local Security Checks	6/1/2007	1/14/2021	medium
25258	Debian DSA-1293-1 : quagga - out of boundary read	Nessus	Debian Local Security Checks	5/20/2007	1/4/2021	medium
29567	SuSE 10 Security Update : quagga (ZYPP Patch Number 3230)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	medium
25354	CentOS 3 / 4 / 5 : quagga (CESA-2007:0389)	Nessus	CentOS Local Security Checks	6/1/2007	1/4/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium