The remote Solaris system is missing necessary patches to address security updates :

  - bgpd in Quagga before 0.99.9 allows explicitly     configured BGP peers to cause a denial of service     (crash) via a malformed (1) OPEN message or (2) a     COMMUNITY attribute, which triggers a NULL pointer     dereference. NOTE: vector 2 only exists when debugging     is enabled. (CVE-2007-4826)

  - The BGP daemon (bgpd) in Quagga 0.99.11 and earlier     allows remote attackers to cause a denial of service     (crash) via an AS path containing ASN elements whose     string representation is longer than expected, which     triggers an assert error. (CVE-2009-1572)

  - The extended-community parser in bgpd in Quagga before     0.99.18 allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash)     via a malformed Extended Communities attribute.
    (CVE-2010-1674)

  - bgpd in Quagga before 0.99.18 allows remote attackers to     cause a denial of service (session reset) via a     malformed AS_PATHLIMIT path attribute. (CVE-2010-1675)

  - Stack-based buffer overflow in the     bgp_route_refresh_receive function in bgp_packet.c in     bgpd in Quagga before 0.99.17 allows remote     authenticated users to cause a denial of service (daemon     crash) or possibly execute arbitrary code via a     malformed Outbound Route Filtering (ORF) record in a BGP     ROUTE-REFRESH (RR) message. (CVE-2010-2948)

  - bgpd in Quagga before 0.99.17 does not properly parse AS     paths, which allows remote attackers to cause a denial     of service (NULL pointer dereference and daemon crash)     via an unknown AS type in an AS path attribute in a BGP     UPDATE message. (CVE-2010-2949)

  - The OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of     service (out-of-bounds memory access and daemon crash)     via a Link State Update message with an invalid IPv6     prefix length. (CVE-2011-3323)

  - The ospf6_lsa_is_changed function in ospf6_lsa.c in the     OSPFv3 implementation in ospf6d in Quagga before 0.99.19     allows remote attackers to cause a denial of service     (assertion failure and daemon exit) via trailing zero     values in the Link State Advertisement (LSA) header list     of an IPv6 Database Description message. (CVE-2011-3324)

  - ospf_packet.c in ospfd in Quagga before 0.99.19 allows     remote attackers to cause a denial of service (daemon     crash) via (1) a 0x0a type field in an IPv4 packet     header or (2) a truncated IPv4 Hello packet.
    (CVE-2011-3325)

  - The ospf_flood function in ospf_flood.c in ospfd in     Quagga before 0.99.19 allows remote attackers to cause a     denial of service (daemon crash) via an invalid Link     State Advertisement (LSA) type in an IPv4 Link State     Update message. (CVE-2011-3326)

fixes CVE-2011-332{3..7} update to latest upstream 0.99.20 fixes memory leak

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-930:01 advisory.

    Quagga is a free software that manages TCP/IP based routing protocol. It takes multi-server and multi-     thread approach to resolve the current complexity of the Internet.
    Quagga supports BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng.
    Quagga is intended to be used as a Route Server and a Route Reflector. It is not a toolkit, it provides     full routing power under a new architecture. Quagga by design has a process for each protocol.
    Quagga is a fork of GNU Zebra.
    Security issues fixed with this release:
     CVE-2010-1674     The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial     of service (NULL pointer dereference and application crash) via a malformed Extended Communities     attribute.
     CVE-2011-3323     The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of     service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid     IPv6 prefix length.
     CVE-2011-3324     The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before     0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via     trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description     message.
     CVE-2011-3325     ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service     (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.
     CVE-2011-3326     The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause     a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link     State Update message.
     CVE-2011-3327     Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga     before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute     arbitrary code by sending a crafted BGP UPDATE message over IPv4.
     CVE-2012-0249     Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in     ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure     and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified     in its header.
     CVE-2012-0250     Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers     to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a     network-LSA link-state advertisement for which the data-structure length is smaller than the value in the     Length header field.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327)

A NULL pointer dereference flaw was found in the way the bgpd daemon processed malformed route Extended Communities attributes. A configured BGP peer could crash bgpd on a target system via a specially crafted BGP message. (CVE-2010-1674)

A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router.
(CVE-2011-3323)

A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324)

A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325)

A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326)

An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249)

A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250)

We would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249 and CVE-2012-0250. CERT-FI acknowledges Riku Hietamki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249 and CVE-2012-0250.

After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically.

ID	名稱	產品	系列	已發布	已更新	嚴重性
80751	Oracle Solaris Third-Party Patch Update : quagga (multiple_denial_of_service_vulnerabilities4)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
56538	Fedora 16 : quagga-0.99.20-2.fc16 (2011-13492)	Nessus	Fedora Local Security Checks	2011/10/19	2021/1/11	high
284207	MiracleLinux 3 : quagga-0.98.6-7.1.0.1.AXS3 (AXSA:2012-930:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
62094	Scientific Linux Security Update : quagga on SL5.x i386/x86_64 (20120912)	Nessus	Scientific Linux Local Security Checks	2012/9/14	2021/1/14	high

偵測

搜尋 Plugin

medium

high

high

high