quagga security update

2006-06-0118:15:40

CentOS Project

lists.centos.org

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.125 Low

EPSS

Percentile

95.5%

JSON

CentOS Errata and Security Advisory CESA-2006:0525

Quagga manages the TCP/IP based routing protocol. It takes a multi-server
and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP
REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP
versions that have been disabled or that have authentication enabled,
allowing a remote attacker to acquire information about the local network.
(CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1
RESPONSE packets when RIPv2 authentication is enabled. It is possible for a
remote attacker to inject arbitrary route information into the RIPd routing
tables. This issue does not affect Quagga configurations where only RIPv2
is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga’s telnet interface. If an
attacker is able to connect to the Quagga telnet interface, it is possible
to cause Quagga to consume vast quantities of CPU resources by issuing a
malformed ‘sh’ command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain
backported patches that correct these issues.

Affected packages:
quagga
quagga-contrib
quagga-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2006:0525

OSVersionArchitecturePackageVersionFilename
CentOS4ia64quagga< 0.98.3-2.4Equagga-0.98.3-2.4E.ia64.rpm
CentOS4ia64quagga-contrib< 0.98.3-2.4Equagga-contrib-0.98.3-2.4E.ia64.rpm
CentOS4ia64quagga-devel< 0.98.3-2.4Equagga-devel-0.98.3-2.4E.ia64.rpm
CentOS3ia64quagga< 0.96.2-11.3Equagga-0.96.2-11.3E.ia64.rpm
CentOS3ia64quagga-contrib< 0.96.2-11.3Equagga-contrib-0.96.2-11.3E.ia64.rpm
CentOS3ia64quagga-devel< 0.96.2-11.3Equagga-devel-0.96.2-11.3E.ia64.rpm
CentOS4alphaquagga< 0.98.3-2.4Equagga-0.98.3-2.4E.alpha.rpm
CentOS4alphaquagga-contrib< 0.98.3-2.4Equagga-contrib-0.98.3-2.4E.alpha.rpm
CentOS4alphaquagga-devel< 0.98.3-2.4Equagga-devel-0.98.3-2.4E.alpha.rpm
CentOS3s390quagga< 0.96.2-11.3Equagga-0.96.2-11.3E.s390.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	4	ia64	quagga	< 0.98.3-2.4E	quagga-0.98.3-2.4E.ia64.rpm
CentOS	4	ia64	quagga-contrib	< 0.98.3-2.4E	quagga-contrib-0.98.3-2.4E.ia64.rpm
CentOS	4	ia64	quagga-devel	< 0.98.3-2.4E	quagga-devel-0.98.3-2.4E.ia64.rpm
CentOS	3	ia64	quagga	< 0.96.2-11.3E	quagga-0.96.2-11.3E.ia64.rpm
CentOS	3	ia64	quagga-contrib	< 0.96.2-11.3E	quagga-contrib-0.96.2-11.3E.ia64.rpm
CentOS	3	ia64	quagga-devel	< 0.96.2-11.3E	quagga-devel-0.96.2-11.3E.ia64.rpm
CentOS	4	alpha	quagga	< 0.98.3-2.4E	quagga-0.98.3-2.4E.alpha.rpm
CentOS	4	alpha	quagga-contrib	< 0.98.3-2.4E	quagga-contrib-0.98.3-2.4E.alpha.rpm
CentOS	4	alpha	quagga-devel	< 0.98.3-2.4E	quagga-devel-0.98.3-2.4E.alpha.rpm
CentOS	3	s390	quagga	< 0.96.2-11.3E	quagga-0.96.2-11.3E.s390.rpm