Executive Summary

Summary
Title Quagga vulnerability
Informations
NameUSN-512-1First vendor Publication2007-09-15
VendorUbuntuLast vendor Modification2007-09-15
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:N/I:N/A:P)
Cvss Base Score3.5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score6.8AuthenticationRequires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
quagga 0.99.2-1ubuntu3.3

Ubuntu 6.10:
quagga 0.99.4-4ubuntu1.2

Ubuntu 7.04:
quagga 0.99.6-2ubuntu3.2

In general, a standard system upgrade is sufficient to affect the
necessary changes.

Details follow:

It was discovered that Quagga did not correctly verify OPEN messages or
COMMUNITY attributes sent from configured peers. Malicious authenticated
remote peers could send a specially crafted message which would cause
bgpd to abort, leading to a denial of service.


Original Source

Url : http://www.ubuntu.com/usn/USN-512-1

CPE : Common Platform Enumeration

TypeDescriptionCount
Application28

OpenVAS Exploits

DateDescription
2011-08-09Name : CentOS Update for quagga CESA-2010:0785 centos5 i386
File : nvt/gb_CESA-2010_0785_quagga_centos5_i386.nasl
2010-11-04Name : CentOS Update for quagga CESA-2010:0785 centos4 i386
File : nvt/gb_CESA-2010_0785_quagga_centos4_i386.nasl
2010-10-22Name : RedHat Update for quagga RHSA-2010:0785-01
File : nvt/gb_RHSA-2010_0785-01_quagga.nasl
2009-03-23Name : Ubuntu Update for quagga vulnerability USN-512-1
File : nvt/gb_ubuntu_USN_512_1.nasl
2009-02-27Name : Fedora Update for quagga FEDORA-2007-2196
File : nvt/gb_fedora_2007_2196_quagga_fc7.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
40494Quagga bgpd Malformed COMMUNITY Attribute Handling DoS
40493Quagga bgpd Malformed OPEN Message Handling DoS

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101020_quagga_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-06-29Name : The remote service may be affected by multiple denial of service vulnerabilit...
File : quagga_0_99_9.nasl - Type : ACT_GATHER_INFO
2010-11-24Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2010-10-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0785.nasl - Type : ACT_GATHER_INFO
2007-11-10Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-512-1.nasl - Type : ACT_GATHER_INFO
2007-11-06Name : The remote Fedora host is missing a security update.
File : fedora_2007-2196.nasl - Type : ACT_GATHER_INFO
2007-10-12Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1382.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:04:37
  • Multiple Updates