自己報告されたバージョン番号によると、リモートホストでリスンする Quagga のインストールが複数の脆弱性による影響を受けています。

- RIPD の情報漏洩の脆弱性が、RIPv1 を無効にする、または平文や MD5 の認証を必要とするホスト上で SEND UPDATE などの REQUEST パケットによって発生される可能性があります。（CVE-2006-2223）

- RIPD の認証バイパスの脆弱性により、認証されていないリモートの攻撃者が、RIPv1 RESPONSE パケットを通じて、ルーティング状態を改ざんする可能性があります。（CVE-2006-2224）

- Zebra のサービス拒否の脆弱性が、特定の BGP コマンドによって発生される可能性があります。（CVE-2006-2276）

根據其自我報告的版本號碼，在遠端主機上接聽之 Quagga 的安裝受到多個弱點影響：

- RIPD 中的一個資訊洩漏弱點可在主機上，被停用 RIPv1 或要求純文字或 MD5 驗證的 REQUEST 封包 (如 SEND UPDATE) 觸發。(CVE-2006-2223)

- RIPD 中的一個驗證繞過弱點可能允許未經驗證的遠端攻擊者透過 RIPv1 RESPONSE 封包修改路由狀態。(CVE-2006-2224)

- Zebra 中的一個拒絕服務弱點可被某些 BGP 命令觸發。(CVE-2006-2276)

根据其自我报告的版本号，在远程主机上侦听的 Quagga 的安装受多种漏洞的影响：

- SEND UPDATE 等 REQUEST 数据包可在禁用 RIPv1 或者要求明文或 MD5 认证的主机上触发 RIPD 中的一个信息泄露漏洞。(CVE-2006-2223)

- RIPD 中的一个认证绕过漏洞可能允许未经认证的远程攻击者通过 RIPv1 RESPONSE 数据包来修改路由状态。(CVE-2006-2224)

- 某个 BGP 命令可触发 Zebra 中的一个拒绝服务漏洞。(CVE-2006-2276)

Konstantin Gavrilenko discovered several vulnerabilities in quagga, the BGP/OSPF/RIP routing daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2223     Remote attackers may obtain sensitive information via     RIPv1 REQUEST packets even if the quagga has been     configured to use MD5 authentication.

  - CVE-2006-2224     Remote attackers could inject arbitrary routes using the     RIPv1 RESPONSE packet even if the quagga has been     configured to use MD5 authentication.

  - CVE-2006-2276     Fredrik Widell discovered that local users can cause a     denial of service in a certain sh ip bgp command entered     in the telnet interface.

Updated quagga packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Quagga manages the TCP/IP based routing protocol. It takes a multi-server and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect Quagga configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an attacker is able to connect to the Quagga telnet interface, it is possible to cause Quagga to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain backported patches that correct these issues.

Paul Jakma discovered that Quagga's ripd daemon did not properly handle authentication of RIPv1 requests. If the RIPv1 protocol had been disabled, or authentication for RIPv2 had been enabled, ripd still replied to RIPv1 requests, which could lead to information disclosure. (CVE-2006-2223)

Paul Jakma also noticed that ripd accepted unauthenticated RIPv1 response packets if RIPv2 was configured to require authentication and both protocols were allowed. A remote attacker could exploit this to inject arbitrary routes. (CVE-2006-2224)

Fredrik Widell discovered that Quagga did not properly handle certain invalid 'sh ip bgp' commands. By sending special commands to Quagga, a remote attacker with telnet access to the Quagga server could exploit this to trigger an endless loop in the daemon (Denial of Service).
(CVE-2006-2276).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200605-15 (Quagga Routing Suite: Multiple vulnerabilities)

    Konstantin V. Gavrilenko discovered two flaws in the Routing     Information Protocol (RIP) daemon that allow the processing of RIP v1     packets (carrying no authentication) even when the daemon is configured     to use MD5 authentication or, in another case, even if RIP v1 is     completely disabled. Additionally, Fredrik Widell reported that the     Border Gateway Protocol (BGP) daemon contains a flaw that makes it lock     up and use all available CPU when a specific command is issued from the     telnet interface.
  Impact :

    By sending RIP v1 response packets, an unauthenticated attacker     can alter the routing table of a router running Quagga's RIP daemon and     disclose routing information. Additionally, it is possible to lock up     the BGP daemon from the telnet interface.
  Workaround :

    There is no known workaround at this time.

Updated zebra packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU Zebra is a free software that manages TCP/IP based routing protocol.

An information disclosure flaw was found in the way GNU Zebra interprets RIP REQUEST packets. RIPd in GNU Zebra will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way GNU Zebra interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect GNU Zebra configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in GNU Zebra's telnet interface. If an attacker is able to connect to the GNU Zebra telnet interface, it is possible to cause GNU Zebra to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of GNU Zebra should upgrade to these updated packages, which contain backported patches that correct these issues.

According to its self-reported version number, the installation of Quagga listening on the remote host is affected by multiple vulnerabilities :

  - An information disclosure vulnerability in RIPD can be     triggered by a REQUEST packet, such as SEND UPDATE, on     hosts that disable RIPv1 or require plaintext or MD5     authentication. (CVE-2006-2223)

  - An authentication bypass vulnerability in RIPD may allow     unauthenticated, remote attackers to modify routing     state via RIPv1 RESPONSE packets. (CVE-2006-2224)

  - A denial of service vulnerability in Zebra can be     triggered by a certain BGP command. (CVE-2006-2276)

ID	名稱	產品	系列	已發布	已更新	嚴重性
59793	Quagga < 0.98.6 / 0.99.4 の複数の脆弱性	Nessus	Misc.	2012/6/29	2019/12/4	medium
59793	Quagga < 0.98.6 / 0.99.4 多個弱點	Nessus	Misc.	2012/6/29	2019/12/4	medium
59793	Quagga < 0.98.6 / 0.99.4 多种漏洞	Nessus	Misc.	2012/6/29	2019/12/4	medium
22601	Debian DSA-1059-1 : quagga - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
21636	RHEL 3 / 4 : quagga (RHSA-2006:0525)	Nessus	Red Hat Local Security Checks	2006/6/5	2021/1/14	medium
21569	Ubuntu 5.04 / 5.10 : quagga vulnerabilities (USN-284-1)	Nessus	Ubuntu Local Security Checks	2006/5/16	2021/1/19	medium
21579	GLSA-200605-15 : Quagga Routing Suite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2006/5/22	2021/1/6	medium
21637	RHEL 2.1 : zebra (RHSA-2006:0533)	Nessus	Red Hat Local Security Checks	2006/6/5	2021/1/14	medium
21904	CentOS 3 / 4 : quagga (CESA-2006:0525)	Nessus	CentOS Local Security Checks	2006/7/3	2021/1/4	medium
59793	Quagga < 0.98.6 / 0.99.4 Multiple Vulnerabilities	Nessus	Misc.	2012/6/29	2019/12/4	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium