Skip to navigation

Security Advisory Moderate: quagga security update

Advisory: RHSA-2011:0406-1
Type: Security Advisory
Severity: Moderate
Issued on: 2011-03-31
Last updated on: 2011-03-31
Affected Products: Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server EUS (v. 6.0.z)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2010-1674
CVE-2010-1675

Details

Updated quagga packages that fix two security issues are now available for
Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon
implements the BGP (Border Gateway Protocol) routing protocol.

A denial of service flaw was found in the way the Quagga bgpd daemon
processed certain route metrics information. A BGP message with a
specially-crafted path limit attribute would cause the bgpd daemon to reset
its session with the peer through which this message was received.
(CVE-2010-1675)

A NULL pointer dereference flaw was found in the way the Quagga bgpd daemon
processed malformed route extended communities attributes. A configured BGP
peer could crash bgpd on a target system via a specially-crafted BGP
message. (CVE-2010-1674)

Users of quagga should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the bgpd daemon must be restarted for the update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

Red Hat Enterprise Linux Server (v. 6)

SRPMS:
quagga-0.99.15-5.el6_0.2.src.rpm
File outdated by:  RHSA-2012:1259
    MD5: b45c791ead433cbd2afcc7765e719800
SHA-256: 9f8fb0ff2f781d3332dbd5f6e30307c7d3cfe50ba7bd34b15e5d78c4cb780863
 
IA-32:
quagga-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 47b06ae652ae9dbb588c7fb2bcad1078
SHA-256: 9c0af2bae5761e04661ed1db09d516135c74b59b826a1010b9292e55f5b2e528
quagga-contrib-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: dce32bcd668f65b1a790c9fb3ca05a2b
SHA-256: 02f149fef85866809d8356da20e1f7b84a16a19d66f116ead3c514702d675747
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-devel-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
 
PPC:
quagga-0.99.15-5.el6_0.2.ppc64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 570f692a0fffa0958997ad1cd57eacc0
SHA-256: 2370ab4a02aa6938c772fc98e58b2da0caf220caf062d3a47153dc085248f736
quagga-contrib-0.99.15-5.el6_0.2.ppc64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 0cf5734fbb585fe4c1029c885b3502b4
SHA-256: 577ce122f11cb333fde2c8723fb6b5bb51a043d36faf4961aa20b17a4fccf2a3
quagga-debuginfo-0.99.15-5.el6_0.2.ppc.rpm
File outdated by:  RHSA-2012:1259
    MD5: 04f721a96b34a0de685fada1f2ebe6cf
SHA-256: 2340d31b047148fa7de1e24a5666faa32e7fbe44dbfa836863bc0cbb3915ee57
quagga-debuginfo-0.99.15-5.el6_0.2.ppc64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 9859610f26384d1b6a6ed4df7da3dabd
SHA-256: b49af919d93ab519ca9643850e0a3c6d00a6410372ece17b5ea7881d59b93ab4
quagga-devel-0.99.15-5.el6_0.2.ppc.rpm
File outdated by:  RHSA-2012:1259
    MD5: 518426be3ea54c2a5912aae5f8b70d01
SHA-256: 616dd66cbf51e541d09e454dd3c87196b1f92f6c142b118c0150d6329887c40b
quagga-devel-0.99.15-5.el6_0.2.ppc64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 4a31cc915bd9db1cc8951a8f73bf7314
SHA-256: 274173620280d365f564cd039cd216597652bae31a7b795bc449617ea23746b1
 
s390x:
quagga-0.99.15-5.el6_0.2.s390x.rpm
File outdated by:  RHSA-2012:1259
    MD5: b10967512c79e6e8b98661180eb0ec2c
SHA-256: 8e18b3f276a27710c929b9202dcb47b43288f97f417547cbc2f3a7c8695981e4
quagga-contrib-0.99.15-5.el6_0.2.s390x.rpm
File outdated by:  RHSA-2012:1259
    MD5: e6102fe438bdf215e54b5276ca4e2f9f
SHA-256: 2bcaa4fc812c163a1a42059efb477162f5446fe2e3dd8da69d2557e4bf8e317e
quagga-debuginfo-0.99.15-5.el6_0.2.s390.rpm
File outdated by:  RHSA-2012:1259
    MD5: d47850482cf45d5e7c02db73f7071082
SHA-256: 058f13e0739f9cbf21801c40827d9bf0e97f381cf52a51fa6a95dad53924ac44
quagga-debuginfo-0.99.15-5.el6_0.2.s390x.rpm
File outdated by:  RHSA-2012:1259
    MD5: d170326d639b2b5e3b03b0ddf5cd3012
SHA-256: df2caf3c4e824c083c550326b9e5cb1c7089174b43260295c6d9f4560389226e
quagga-devel-0.99.15-5.el6_0.2.s390.rpm
File outdated by:  RHSA-2012:1259
    MD5: bb411ee36b9a454c21d4461a2b109db3
SHA-256: 809fef5e836ebef0c2cfc827d7c2d9aa79399bec383d86a5bc2bcc39a22cb2b2
quagga-devel-0.99.15-5.el6_0.2.s390x.rpm
File outdated by:  RHSA-2012:1259
    MD5: 66d76d82af087d564d39ea78e853b4ba
SHA-256: b5d91ad4a6834fb5ac1ce9f8dce784edf4b9555271745a7b3c62da988c93ea41
 
x86_64:
quagga-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 5e9dcddbf86601c036c1f29d5196932b
SHA-256: bcf9288821de6effb1174d82c4db8cd5b25a921dbed21588618a76bb2bd9e4e7
quagga-contrib-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 646084b941a36c93c60995795d2ba567
SHA-256: 4c83cc499ea43d39114e80f0ea9e234ca9cbd71c1c0f55ee41537e5ad2944a5b
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-debuginfo-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 6365900e9a4151911c2a5367f225f213
SHA-256: b9e4523fd5736b71b487692ba0616fe1c5831febe6637b4200a9a5781b9adf86
quagga-devel-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
quagga-devel-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 45b52dccb92041f5d672f8d664ac3bfc
SHA-256: 4dd661758396e008bd68a4cbdb5db74776c9b8a7e2e571a432634397aac70aaa
 
Red Hat Enterprise Linux Server EUS (v. 6.0.z)

SRPMS:
quagga-0.99.15-5.el6_0.2.src.rpm
File outdated by:  RHSA-2012:1259
    MD5: b45c791ead433cbd2afcc7765e719800
SHA-256: 9f8fb0ff2f781d3332dbd5f6e30307c7d3cfe50ba7bd34b15e5d78c4cb780863
 
IA-32:
quagga-0.99.15-5.el6_0.2.i686.rpm     MD5: 47b06ae652ae9dbb588c7fb2bcad1078
SHA-256: 9c0af2bae5761e04661ed1db09d516135c74b59b826a1010b9292e55f5b2e528
quagga-contrib-0.99.15-5.el6_0.2.i686.rpm     MD5: dce32bcd668f65b1a790c9fb3ca05a2b
SHA-256: 02f149fef85866809d8356da20e1f7b84a16a19d66f116ead3c514702d675747
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm     MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-devel-0.99.15-5.el6_0.2.i686.rpm     MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
 
PPC:
quagga-0.99.15-5.el6_0.2.ppc64.rpm     MD5: 570f692a0fffa0958997ad1cd57eacc0
SHA-256: 2370ab4a02aa6938c772fc98e58b2da0caf220caf062d3a47153dc085248f736
quagga-contrib-0.99.15-5.el6_0.2.ppc64.rpm     MD5: 0cf5734fbb585fe4c1029c885b3502b4
SHA-256: 577ce122f11cb333fde2c8723fb6b5bb51a043d36faf4961aa20b17a4fccf2a3
quagga-debuginfo-0.99.15-5.el6_0.2.ppc.rpm     MD5: 04f721a96b34a0de685fada1f2ebe6cf
SHA-256: 2340d31b047148fa7de1e24a5666faa32e7fbe44dbfa836863bc0cbb3915ee57
quagga-debuginfo-0.99.15-5.el6_0.2.ppc64.rpm     MD5: 9859610f26384d1b6a6ed4df7da3dabd
SHA-256: b49af919d93ab519ca9643850e0a3c6d00a6410372ece17b5ea7881d59b93ab4
quagga-devel-0.99.15-5.el6_0.2.ppc.rpm     MD5: 518426be3ea54c2a5912aae5f8b70d01
SHA-256: 616dd66cbf51e541d09e454dd3c87196b1f92f6c142b118c0150d6329887c40b
quagga-devel-0.99.15-5.el6_0.2.ppc64.rpm     MD5: 4a31cc915bd9db1cc8951a8f73bf7314
SHA-256: 274173620280d365f564cd039cd216597652bae31a7b795bc449617ea23746b1
 
s390x:
quagga-0.99.15-5.el6_0.2.s390x.rpm     MD5: b10967512c79e6e8b98661180eb0ec2c
SHA-256: 8e18b3f276a27710c929b9202dcb47b43288f97f417547cbc2f3a7c8695981e4
quagga-contrib-0.99.15-5.el6_0.2.s390x.rpm     MD5: e6102fe438bdf215e54b5276ca4e2f9f
SHA-256: 2bcaa4fc812c163a1a42059efb477162f5446fe2e3dd8da69d2557e4bf8e317e
quagga-debuginfo-0.99.15-5.el6_0.2.s390.rpm     MD5: d47850482cf45d5e7c02db73f7071082
SHA-256: 058f13e0739f9cbf21801c40827d9bf0e97f381cf52a51fa6a95dad53924ac44
quagga-debuginfo-0.99.15-5.el6_0.2.s390x.rpm     MD5: d170326d639b2b5e3b03b0ddf5cd3012
SHA-256: df2caf3c4e824c083c550326b9e5cb1c7089174b43260295c6d9f4560389226e
quagga-devel-0.99.15-5.el6_0.2.s390.rpm     MD5: bb411ee36b9a454c21d4461a2b109db3
SHA-256: 809fef5e836ebef0c2cfc827d7c2d9aa79399bec383d86a5bc2bcc39a22cb2b2
quagga-devel-0.99.15-5.el6_0.2.s390x.rpm     MD5: 66d76d82af087d564d39ea78e853b4ba
SHA-256: b5d91ad4a6834fb5ac1ce9f8dce784edf4b9555271745a7b3c62da988c93ea41
 
x86_64:
quagga-0.99.15-5.el6_0.2.x86_64.rpm     MD5: 5e9dcddbf86601c036c1f29d5196932b
SHA-256: bcf9288821de6effb1174d82c4db8cd5b25a921dbed21588618a76bb2bd9e4e7
quagga-contrib-0.99.15-5.el6_0.2.x86_64.rpm     MD5: 646084b941a36c93c60995795d2ba567
SHA-256: 4c83cc499ea43d39114e80f0ea9e234ca9cbd71c1c0f55ee41537e5ad2944a5b
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm     MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-debuginfo-0.99.15-5.el6_0.2.x86_64.rpm     MD5: 6365900e9a4151911c2a5367f225f213
SHA-256: b9e4523fd5736b71b487692ba0616fe1c5831febe6637b4200a9a5781b9adf86
quagga-devel-0.99.15-5.el6_0.2.i686.rpm     MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
quagga-devel-0.99.15-5.el6_0.2.x86_64.rpm     MD5: 45b52dccb92041f5d672f8d664ac3bfc
SHA-256: 4dd661758396e008bd68a4cbdb5db74776c9b8a7e2e571a432634397aac70aaa
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
quagga-0.99.15-5.el6_0.2.src.rpm
File outdated by:  RHSA-2012:1259
    MD5: b45c791ead433cbd2afcc7765e719800
SHA-256: 9f8fb0ff2f781d3332dbd5f6e30307c7d3cfe50ba7bd34b15e5d78c4cb780863
 
IA-32:
quagga-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 47b06ae652ae9dbb588c7fb2bcad1078
SHA-256: 9c0af2bae5761e04661ed1db09d516135c74b59b826a1010b9292e55f5b2e528
quagga-contrib-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: dce32bcd668f65b1a790c9fb3ca05a2b
SHA-256: 02f149fef85866809d8356da20e1f7b84a16a19d66f116ead3c514702d675747
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-devel-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
 
x86_64:
quagga-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 5e9dcddbf86601c036c1f29d5196932b
SHA-256: bcf9288821de6effb1174d82c4db8cd5b25a921dbed21588618a76bb2bd9e4e7
quagga-contrib-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 646084b941a36c93c60995795d2ba567
SHA-256: 4c83cc499ea43d39114e80f0ea9e234ca9cbd71c1c0f55ee41537e5ad2944a5b
quagga-debuginfo-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 532affe349c77b197a532d5c84497334
SHA-256: a9b7511b62c53758097c4b61453a6c2fc6b1e5c7c7490f66999294770fff2a33
quagga-debuginfo-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 6365900e9a4151911c2a5367f225f213
SHA-256: b9e4523fd5736b71b487692ba0616fe1c5831febe6637b4200a9a5781b9adf86
quagga-devel-0.99.15-5.el6_0.2.i686.rpm
File outdated by:  RHSA-2012:1259
    MD5: 020552a07a66d2d26bd1701a30774529
SHA-256: 196053312f6353df2f75700951a2359a910abeafd5ef81ab2dc66a7bedaff8f7
quagga-devel-0.99.15-5.el6_0.2.x86_64.rpm
File outdated by:  RHSA-2012:1259
    MD5: 45b52dccb92041f5d672f8d664ac3bfc
SHA-256: 4dd661758396e008bd68a4cbdb5db74776c9b8a7e2e571a432634397aac70aaa
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

654603 - CVE-2010-1674 quagga: DoS (crash) by processing malformed extended community attribute in a route
654614 - CVE-2010-1675 quagga: BGP session reset by processing BGP Update message with malformed AS-path attributes


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/