[security-alerts] FW: [SA19910] Quagga RIPd RIPv1 Request Handling Security Issue

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> Quagga RIPd RIPv1 Request Handling Security Issue
> 
> SECUNIA ADVISORY ID:
> SA19910
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/19910/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Security Bypass, Exposure of system information
> 
> WHERE:
> From local network
> 
> SOFTWARE:
> Quagga 0.x
> http://secunia.com/product/4731/
> 
> DESCRIPTION:
> Konstantin V. Gavrilenko has reported two security issues in Quagga,
> which can be exploited by malicious people to bypass certain security
> restrictions and to disclose system information.
> 
> 1) An error in RIPd causes RIPv1 RESPONSE packets to be accepted for
> routing state update, even when RIPv2 authentication has been
> enabled. This can potentially be exploited to inject malicious route
> into the RIP daemon.
> 
> 2) An error in RIPd causes it to respond to RIPv1 SEND UPDATE
> requests and to send out routing table information, even when RIPv2
> authentication has been enabled. This can potentially be exploited to
> obtain route information.
> 
> The security issues have been reported in 0.98.3 and 0.99.5. Other
> versions may also be affected.
> 
> SOLUTION:
> The security issues have been fixed in the CVS repositories.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Konstantin V. Gavrilenko
> 
> ORIGINAL ADVISORY:
> http://bugzilla.quagga.net/show_bug.cgi?id=261
> http://bugzilla.quagga.net/show_bug.cgi?id=262
>