Executive Summary

Summary
Title Quagga vulnerability
Informations
NameUSN-512-1First vendor Publication2007-09-15
VendorUbuntuLast vendor Modification2007-09-15
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:N/I:N/A:P)
Cvss Base Score3.5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score6.8AuthenticationRequires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 6.06 LTS:
quagga 0.99.2-1ubuntu3.3

Ubuntu 6.10:
quagga 0.99.4-4ubuntu1.2

Ubuntu 7.04:
quagga 0.99.6-2ubuntu3.2

In general, a standard system upgrade is sufficient to affect the necessary changes.

Details follow:

It was discovered that Quagga did not correctly verify OPEN messages or COMMUNITY attributes sent from configured peers. Malicious authenticated remote peers could send a specially crafted message which would cause bgpd to abort, leading to a denial of service.

Original Source

Url : http://www.ubuntu.com/usn/USN-512-1

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20392
 
Oval ID: oval:org.mitre.oval:def:20392
Title: DSA-1382-1 quagga
Description: It was discovered that BGP peers can trigger a NULL pointer dereference in the BGP daemon if debug logging is enabled, causing the BGP daemon to crash.
Family: unix Class: patch
Reference(s): DSA-1382-1
CVE-2007-4826
Version: 5
Platform(s): Debian GNU/Linux 4.0
Product(s): quagga
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17555
 
Oval ID: oval:org.mitre.oval:def:17555
Title: USN-512-1 -- quagga vulnerability
Description: It was discovered that Quagga did not correctly verify OPEN messages or COMMUNITY attributes sent from configured peers.
Family: unix Class: patch
Reference(s): USN-512-1
CVE-2007-4826
Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 6.10
Ubuntu 7.04
Product(s): quagga
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application28

OpenVAS Exploits

DateDescription
2011-08-09Name : CentOS Update for quagga CESA-2010:0785 centos5 i386
File : nvt/gb_CESA-2010_0785_quagga_centos5_i386.nasl
2010-11-04Name : CentOS Update for quagga CESA-2010:0785 centos4 i386
File : nvt/gb_CESA-2010_0785_quagga_centos4_i386.nasl
2010-10-22Name : RedHat Update for quagga RHSA-2010:0785-01
File : nvt/gb_RHSA-2010_0785-01_quagga.nasl
2009-03-23Name : Ubuntu Update for quagga vulnerability USN-512-1
File : nvt/gb_ubuntu_USN_512_1.nasl
2009-02-27Name : Fedora Update for quagga FEDORA-2007-2196
File : nvt/gb_fedora_2007_2196_quagga_fc7.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
40494Quagga bgpd Malformed COMMUNITY Attribute Handling DoS
40493Quagga bgpd Malformed OPEN Message Handling DoS

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101020_quagga_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-06-29Name : The remote service may be affected by multiple denial of service vulnerabilit...
File : quagga_0_99_9.nasl - Type : ACT_GATHER_INFO
2010-11-24Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2010-10-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2007-11-10Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-512-1.nasl - Type : ACT_GATHER_INFO
2007-11-06Name : The remote Fedora host is missing a security update.
File : fedora_2007-2196.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1382.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:04:37
  • Multiple Updates