Info

Disclosure

May 03, 2006

Discovery

Unknown

Dates

Exploit

May 03, 2006

Solution

Unknown

Description

Quagga contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a RIPv1 'SEND UPDATE' request is sent to the 'RIPd' service, even when it is configured to support RIPv2 only. This will also happen when the RIPv2-only service is configued to work with MD5 authentication. The vulnerability will disclose the service's RIP routing table, resulting in a loss of confidentiality.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to version 0.98 release candidate 20060504 or 0.99 release candidate 20060504, respectively, or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by filtering RIPv1 traffic on a need-to-access basis.

Products

Quagga	Quagga	0.98.5
		0.99.3

References

Bugtraq ID: 17808
Secunia Advisory ID: 19910 20137 20138 20221 20420 20421 20782 21159
CVE ID: 2006-2223 (see also: NVD)
Related OSVDB ID: 25225
Keyword: arh200604-1
Other Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0029.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0035.html
Vendor Specific News/Changelog Entry: http://bugzilla.quagga.net/show_bug.cgi?id=261
Vendor Specific Advisory URL: http://lists.suse.com/archive/suse-security-announce/2006-Jul/0007.html
http://www.gentoo.org/security/en/glsa/glsa-200605-15.xml
http://www.ubuntu.com/usn/usn-284-1
http://www.us.debian.org/security/2006/dsa-1059
Vendor URL: http://www.quagga.net/
RedHat RHSA: RHSA-2006:0525 RHSA-2006:0533

Credit

Konstantin V. Gavrilenko - k.gavrilenkoarhont.com - Arhont Ltd - Information Security

Direct URL: http://osvdb.org/25224