Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Open Shortest Path First（OSPF）プロトコルの実装が、MaxSequenceNumber のある LSA の Link State Advertisement（LSA）の最新性を不適切に判断する可能性があります。RFC 2328セクション 13.1によると、同じLSAの2つのインスタンスについて、最新性は最初にシーケンス番号、次にチェックサム、最後にMaxAgeを比較することによって決定されます。シーケンス番号が同じ場合、チェックサムが大きい LSA が最近のものと見なされ、Link State Database (LSDB) からフラッシュされません。MaxSequenceNumber のある自己由来 LSA を時期尚早にエージングするとき、LSA によって伝送されるリンクの値が同じでなければならないことを RFC が明確に述べていないため、脆弱な OSPF 実装では、攻撃者が MaxSequenceNumber と無効なリンクを使用して LSA を作成することが可能です。これによりチェックサムが大きくなり、LSDB からフラッシュされない「新しい」LSA になります。細工されたLSAの伝播により、ルーティングドメイン内のルーターのルーティングテーブルが消去または変更され、ネットワーク上でサービス拒否状態またはトラフィックの再ルーティングが引き起こされる可能性があります。 CVE-2017-3224 は、Quagga およびダウンストリームの実装（SUSE、openSUSE、Red Hat のパッケージ）用に予約されています。 （CVE-2017-3224）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 开放最短路径优先 (OSPF) 协议实现可能会错误地确定具有 MaxSequenceNumber 的 LSA 的链路状态通告 (LSA) 新近度。根据 RFC 2328 部分 13.1，对于同一 LSA 的两个实例，确定新近度的方式是首先比较序列号，然后是校验和，最后是 MaxAge。在序列号相同的情况下，具有较大校验和的 LSA 被视为较新，并且不会从链路状态数据库 (LSDB) 中刷新。由于 RFC 未明确声明使用 MaxSequenceNumber 自我生成的 LSA 时效时 LSA 携带的链接的值必须相同，在易受攻击的 OSPF 实现中，攻击者可能会特制带有 MaxSequenceNumber 的 LSA 和无效链接这将导致较大的校验和，从而导致不会从 LSDB 中刷新的“较新”LSA。传播特制的 LSA 时，可擦除或变更路由域内的路由器的路由表，造成拒绝服务情况或在网络上重新路由流量。 CVE-2017-3224 已保留给 Quagga 及下游实现（SUSE、openSUSE 和 Red Hat 程序包）。 (CVE-2017-3224)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Open Shortest Path First (OSPF) 通訊協定實作可能以 MaxSequenceNumber 不當判斷 LSA 的連結狀態公告 (LSA) 新近度。根據 RFC 2328 區段 13.1，對於相同 LSA 的兩個執行個體，新近度的確定方式為先比較序號，然後是總和檢查碼，最後是 MaxAge。在序號相同的情況下，具有較大總和檢查碼的 LSA 會被視為較新，且不會從連結狀態資料庫 (LSDB) 中清除。由於 RFC 未明確規定在具有 MaxSequenceNumber 的自我來源 LSA 過早時效時，LSA 承載的連結值必須相同，因此在有弱點的 OSPF 實作中，攻擊者可能特製具有 MaxSequenceNumber 和無效連結的 LSA這將導致更大的總和檢查碼，因此不會從 LSDB 排清「較新」的 LSA。特製 LSA 的傳播可導致刪除或變更路由網域內路由器的路由表，進而造成拒絕服務情形或網路上流量重新路由。 CVE-2017-3224 已保留給 Quagga 和下游實作 (SUSE、openSUSE 和 Red Hat 套件) 使用。 (CVE-2017-3224)

請注意，Nessus 依賴供應商報告的套件存在。

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement     (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of     the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally     MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered     more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not     explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-     originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker     to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a     'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers within the routing domain, creating a denial of     service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga     and downstream implementations (SUSE, openSUSE, and Red Hat packages). (CVE-2017-3224)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
221138	Linux Distros のパッチ未適用の脆弱性: CVE-2017-3224	Nessus	Misc.	2025/3/4	2025/3/4	high
221138	Linux Distros 未修补的漏洞: CVE-2017-3224	Nessus	Misc.	2025/3/4	2025/3/4	high
221138	Linux Distros 未修補弱點：CVE-2017-3224	Nessus	Misc.	2025/3/4	2025/3/4	high
131900	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2019-2408)	Nessus	Huawei Local Security Checks	2019/12/10	2022/12/5	critical
132192	EulerOS 2.0 SP3 : quagga (EulerOS-SA-2019-2657)	Nessus	Huawei Local Security Checks	2019/12/18	2022/12/5	critical
146136	EulerOS 2.0 SP5 : quagga (EulerOS-SA-2021-1227)	Nessus	Huawei Local Security Checks	2021/2/4	2025/2/20	high
221138	Linux Distros Unpatched Vulnerability : CVE-2017-3224	Nessus	Misc.	2025/3/4	2025/3/4	high

偵測

搜尋 Plugin

high

high

high

critical

critical

high

high