Multiple vulnerabilities in quagga.net Quagga

1) Buffer overflow

EUVDB-ID: #VU44159

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2012-0249

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Quagga: 0.95 - 0.99.19

CPE2.3

External links

https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html
https://rhn.redhat.com/errata/RHSA-2012-1258.html
https://rhn.redhat.com/errata/RHSA-2012-1259.html
https://secunia.com/advisories/48949
https://www.debian.org/security/2012/dsa-2459
https://www.kb.cert.org/vuls/id/551715
https://bugzilla.quagga.net/show_bug.cgi?id=705

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU44160

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2012-0250

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Quagga: 0.99.1 - 0.99.19

CPE2.3

External links

https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html
https://rhn.redhat.com/errata/RHSA-2012-1258.html
https://rhn.redhat.com/errata/RHSA-2012-1259.html
https://secunia.com/advisories/48949
https://www.debian.org/security/2012/dsa-2459
https://www.kb.cert.org/vuls/id/551715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU44161

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-0255

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Quagga: 0.95 - 0.99.19

CPE2.3

External links

https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078794.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078910.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/078926.html
https://rhn.redhat.com/errata/RHSA-2012-1259.html
https://secunia.com/advisories/48949
https://www.debian.org/security/2012/dsa-2459
https://www.kb.cert.org/vuls/id/551715

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2012-0249 CVE-2012-0250 CVE-2012-0255
CWE-ID	CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Quagga Server applications / Other server solutions
Vendor	quagga.net