Vulnerability Note VU#668534
Multiple Quagga remote component vulnerabilities
Quagga contains five remote component vulnerabilities due to issues when handling BGP, OSPF, and OSPFv3 packets.
Quagga is an open source routing software that can handle various routing protocols such as RIP, BGP and OSPF. Five vulnerabilities have been found in the BGP, OSPF and OSPFv3 components of Quagga. The vulnerabilities allow an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified packets to an affected server. Routing messages are typically accepted from the routing peers. Exploiting these vulnerabilities may require an established routing session (BGP peering or OSPF/OSPFv3 adjacency) to the router.
An attacker could exploit these vulnerabilities to cause a denial-of-service crash or may execute arbitrary code on the affected server with the permissions of the Quagga software.
Vendor Information (Learn More)
Quagga before version 0.99.19
|Vendor||Status||Date Notified||Date Updated|
|Debian GNU/Linux||Affected||14 Sep 2011||06 Oct 2011|
|Red Hat, Inc.||Affected||14 Sep 2011||26 Sep 2011|
|Openwall GNU/*/Linux||Not Affected||14 Sep 2011||16 Sep 2011|
|Wind River Systems, Inc.||Not Affected||14 Sep 2011||22 Sep 2011|
|Apple Inc.||Unknown||14 Sep 2011||14 Sep 2011|
|Conectiva Inc.||Unknown||14 Sep 2011||14 Sep 2011|
|Cray Inc.||Unknown||14 Sep 2011||14 Sep 2011|
|DragonFly BSD Project||Unknown||14 Sep 2011||14 Sep 2011|
|EMC Corporation||Unknown||14 Sep 2011||14 Sep 2011|
|Engarde Secure Linux||Unknown||14 Sep 2011||14 Sep 2011|
|F5 Networks, Inc.||Unknown||14 Sep 2011||14 Sep 2011|
|Fedora Project||Unknown||14 Sep 2011||14 Sep 2011|
|FreeBSD Project||Unknown||14 Sep 2011||14 Sep 2011|
|Fujitsu||Unknown||14 Sep 2011||14 Sep 2011|
|Gentoo Linux||Unknown||14 Sep 2011||14 Sep 2011|
CVSS Metrics (Learn More)
Thanks to Riku Hietamäki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project for reporting this vulnerability to CERT-FI.
This document was written by Michael Orlando.
- CVE IDs: CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327
- Date Public: 26 Sep 2011
- Date First Published: 26 Sep 2011
- Date Last Updated: 06 Oct 2011
- Severity Metric: 15.69
- Document Revision: 9
If you have feedback, comments, or additional information about this vulnerability, please send us email.