Synopsis

quagga security update

Type/Severity

Security Advisory: Moderate

Topic

Updated quagga packages that fix several security vulnerabilities are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Quagga manages the TCP/IP based routing protocol. It takes a multi-server
and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP
REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP
versions that have been disabled or that have authentication enabled,
allowing a remote attacker to acquire information about the local network.
(CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1
RESPONSE packets when RIPv2 authentication is enabled. It is possible for a
remote attacker to inject arbitrary route information into the RIPd routing
tables. This issue does not affect Quagga configurations where only RIPv2
is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an
attacker is able to connect to the Quagga telnet interface, it is possible
to cause Quagga to consume vast quantities of CPU resources by issuing a
malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain
backported patches that correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 191080 - CVE-2006-2223 Quagga RIPd information disclosure
• BZ - 191084 - CVE-2006-2224 Quagga RIPd route injection
• BZ - 191376 - CVE-2006-2276 quagga locks with command sh ip bgp

CVEs

• CVE-2006-2276
• CVE-2006-2223
• CVE-2006-2224

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
quagga-0.98.3-2.4E.src.rpm	SHA-256: da2968e3ee13a8073d615b24df6eee78a4e7dbc6e21d67543b4d8ba21f8e4271
x86_64
quagga-0.98.3-2.4E.x86_64.rpm	SHA-256: 6f7b015f3c9bb685dbef616268d4f652d7f282bf232551ce9e60f4e038bceaa4
quagga-0.98.3-2.4E.x86_64.rpm	SHA-256: 6f7b015f3c9bb685dbef616268d4f652d7f282bf232551ce9e60f4e038bceaa4
quagga-contrib-0.98.3-2.4E.x86_64.rpm	SHA-256: 0d87d453e712f4a4881121464b08688f001dca67bef2289193e7b3eb34cfbb08
quagga-contrib-0.98.3-2.4E.x86_64.rpm	SHA-256: 0d87d453e712f4a4881121464b08688f001dca67bef2289193e7b3eb34cfbb08
quagga-devel-0.98.3-2.4E.x86_64.rpm	SHA-256: 154441d2b56c7f3f6c5de5ccdbe3b5585fd6a99648b93727409c0dad430f0ae1
quagga-devel-0.98.3-2.4E.x86_64.rpm	SHA-256: 154441d2b56c7f3f6c5de5ccdbe3b5585fd6a99648b93727409c0dad430f0ae1
ia64
quagga-0.98.3-2.4E.ia64.rpm	SHA-256: 6ec5d98491e20bc4f347ca894e8559b99b4427520a920fbccdaa76dfa58149bc
quagga-0.98.3-2.4E.ia64.rpm	SHA-256: 6ec5d98491e20bc4f347ca894e8559b99b4427520a920fbccdaa76dfa58149bc
quagga-contrib-0.98.3-2.4E.ia64.rpm	SHA-256: c3246c8ac05b366df4cf6f6804e9833a446e6668d3e2f83a572c4f7b32843943
quagga-contrib-0.98.3-2.4E.ia64.rpm	SHA-256: c3246c8ac05b366df4cf6f6804e9833a446e6668d3e2f83a572c4f7b32843943
quagga-devel-0.98.3-2.4E.ia64.rpm	SHA-256: 3a667f86ebbb61f97ab87c4cd099f12fa1055e2c6e4f58f6d808432c50300bea
quagga-devel-0.98.3-2.4E.ia64.rpm	SHA-256: 3a667f86ebbb61f97ab87c4cd099f12fa1055e2c6e4f58f6d808432c50300bea
i386
quagga-0.98.3-2.4E.i386.rpm	SHA-256: b4f99adf7f645fad99f372ce1f86b53cc45db9c947636eba4b0db279ae11ca33
quagga-0.98.3-2.4E.i386.rpm	SHA-256: b4f99adf7f645fad99f372ce1f86b53cc45db9c947636eba4b0db279ae11ca33
quagga-contrib-0.98.3-2.4E.i386.rpm	SHA-256: 5119464652017842cc294a85e8e3e94dafa92b33182750705c73c24976b2ec3b
quagga-contrib-0.98.3-2.4E.i386.rpm	SHA-256: 5119464652017842cc294a85e8e3e94dafa92b33182750705c73c24976b2ec3b
quagga-devel-0.98.3-2.4E.i386.rpm	SHA-256: 65bee9ad3d0f6d567bdda6a47b47b74589fd5959ac9a285e6660dae8d63f69c3
quagga-devel-0.98.3-2.4E.i386.rpm	SHA-256: 65bee9ad3d0f6d567bdda6a47b47b74589fd5959ac9a285e6660dae8d63f69c3

Red Hat Enterprise Linux Workstation 4

SRPM
quagga-0.98.3-2.4E.src.rpm	SHA-256: da2968e3ee13a8073d615b24df6eee78a4e7dbc6e21d67543b4d8ba21f8e4271
x86_64
quagga-0.98.3-2.4E.x86_64.rpm	SHA-256: 6f7b015f3c9bb685dbef616268d4f652d7f282bf232551ce9e60f4e038bceaa4
quagga-contrib-0.98.3-2.4E.x86_64.rpm	SHA-256: 0d87d453e712f4a4881121464b08688f001dca67bef2289193e7b3eb34cfbb08
quagga-devel-0.98.3-2.4E.x86_64.rpm	SHA-256: 154441d2b56c7f3f6c5de5ccdbe3b5585fd6a99648b93727409c0dad430f0ae1
ia64
quagga-0.98.3-2.4E.ia64.rpm	SHA-256: 6ec5d98491e20bc4f347ca894e8559b99b4427520a920fbccdaa76dfa58149bc
quagga-contrib-0.98.3-2.4E.ia64.rpm	SHA-256: c3246c8ac05b366df4cf6f6804e9833a446e6668d3e2f83a572c4f7b32843943
quagga-devel-0.98.3-2.4E.ia64.rpm	SHA-256: 3a667f86ebbb61f97ab87c4cd099f12fa1055e2c6e4f58f6d808432c50300bea
i386
quagga-0.98.3-2.4E.i386.rpm	SHA-256: b4f99adf7f645fad99f372ce1f86b53cc45db9c947636eba4b0db279ae11ca33
quagga-contrib-0.98.3-2.4E.i386.rpm	SHA-256: 5119464652017842cc294a85e8e3e94dafa92b33182750705c73c24976b2ec3b
quagga-devel-0.98.3-2.4E.i386.rpm	SHA-256: 65bee9ad3d0f6d567bdda6a47b47b74589fd5959ac9a285e6660dae8d63f69c3

Red Hat Enterprise Linux Desktop 4

SRPM
quagga-0.98.3-2.4E.src.rpm	SHA-256: da2968e3ee13a8073d615b24df6eee78a4e7dbc6e21d67543b4d8ba21f8e4271
x86_64
quagga-0.98.3-2.4E.x86_64.rpm	SHA-256: 6f7b015f3c9bb685dbef616268d4f652d7f282bf232551ce9e60f4e038bceaa4
quagga-contrib-0.98.3-2.4E.x86_64.rpm	SHA-256: 0d87d453e712f4a4881121464b08688f001dca67bef2289193e7b3eb34cfbb08
quagga-devel-0.98.3-2.4E.x86_64.rpm	SHA-256: 154441d2b56c7f3f6c5de5ccdbe3b5585fd6a99648b93727409c0dad430f0ae1
i386
quagga-0.98.3-2.4E.i386.rpm	SHA-256: b4f99adf7f645fad99f372ce1f86b53cc45db9c947636eba4b0db279ae11ca33
quagga-contrib-0.98.3-2.4E.i386.rpm	SHA-256: 5119464652017842cc294a85e8e3e94dafa92b33182750705c73c24976b2ec3b
quagga-devel-0.98.3-2.4E.i386.rpm	SHA-256: 65bee9ad3d0f6d567bdda6a47b47b74589fd5959ac9a285e6660dae8d63f69c3

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
quagga-0.98.3-2.4E.src.rpm	SHA-256: da2968e3ee13a8073d615b24df6eee78a4e7dbc6e21d67543b4d8ba21f8e4271
s390x
quagga-0.98.3-2.4E.s390x.rpm	SHA-256: 8d5601aa0acb81d1315e68e654c0f4dd46e1f15e86151b42f25ceb961df36bae
quagga-contrib-0.98.3-2.4E.s390x.rpm	SHA-256: 0383b60fe61cd5d657804362b3d6c5c82ad3a3ead65bf731ca03568bc0ff042d
quagga-devel-0.98.3-2.4E.s390x.rpm	SHA-256: 1bd32eafa328936bce3a35c14247f863aa2b6fb175f886437d6a4f1e8b5505c8
s390
quagga-0.98.3-2.4E.s390.rpm	SHA-256: 76d7858947c785dbe47421c3cd2582922e2796188e91c22afc014db8f4a2452f
quagga-contrib-0.98.3-2.4E.s390.rpm	SHA-256: 1c435b7af83a271626f687f31112709c6a46bf973e5cc0d304023a821ffaab4e
quagga-devel-0.98.3-2.4E.s390.rpm	SHA-256: c50fe4a76746198da2daef2d20e4a1385e8ae0bd68f36d14527edf76c8355148

Red Hat Enterprise Linux for Power, big endian 4

SRPM
quagga-0.98.3-2.4E.src.rpm	SHA-256: da2968e3ee13a8073d615b24df6eee78a4e7dbc6e21d67543b4d8ba21f8e4271
ppc
quagga-0.98.3-2.4E.ppc.rpm	SHA-256: 8571855cb75d6a12d10ad4bc59e5f3c233095c2877a29f8a4066fdf89212c529
quagga-contrib-0.98.3-2.4E.ppc.rpm	SHA-256: 9358a8d155901526a9afd0dd0e7581ddc22b288653556a8836a8ac6d6a7131ca
quagga-devel-0.98.3-2.4E.ppc.rpm	SHA-256: cb20afba5944e388f563d8919cde0e9ecff9b191e9880da45be996271f29e7dc