quagga: fixing multiple vulnerabilities
This update fixes the following security issues:
- 718056: OSPF6D buffer overflow while decoding Link State
Update with Inter Area Prefix Lsa (CVE-2011-3323)
- 718058: OSPF6D DoS while decoding Database Description
packet (CVE-2011-3324)
- 718059: OSPFD DoS while decoding Hello packet
(CVE-2011-3325)
- 718061: OSPFD DoS while decoding Link State Update
(CVE-2011-3326)
- 718062: DoS while decoding EXTENDED_COMMUNITIES in
Quagga's BGP (CVE-2011-3327)
-
Submitted by
Adrian Schröter (adrianSuSE)
- Version 5276
Fixed bugs
bnc#718061
VUL-0: quagga: OSPFD DoS while decoding Link State Update
bnc#718056
VUL-0: quagga: OSPF6D buffer overflow while decoding Link State Update with Inter Area Prefix Lsa
bnc#718058
VUL-0: quagga: OSPF6D DoS while decoding Database Description packet
bnc#718059
VUL-0: quagga: OSPFD DoS while decoding Hello packet
bnc#718062
VUL-0: quagga: DoS while decoding EXTENDED_COMMUNITIES in Quaggas BGP
CVE#CVE-2011-3323
The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.
CVE#CVE-2011-3324
The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisem
CVE#CVE-2011-3325
ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.
CVE#CVE-2011-3326
The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.
CVE#CVE-2011-3327
Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE mess
