Joined: 12 May 2004
|Posted: Mon Oct 10, 2016 8:26 am Post subject: [ GLSA 201610-03 ] Quagga
|Gentoo Linux Security Advisory
Title: Quagga: Arbitrary code execution (GLSA 201610-03)
Date: October 10, 2016
A buffer overflow in Quagga might allow remote attackers to execute
Quagga is a free routing daemon replacing Zebra supporting RIP, OSPF and
Vulnerable: < 1.0.20160315
Unaffected: >= 1.0.20160315
Architectures: All supported architectures
A memcpy function in the VPNv4 NLRI parser of bgp_mplsvpn.c does not
properly check the upper-bound length of received Labeled-VPN SAFI routes
data, which may allow for arbitrary code execution on the stack.
A remote attacker could send a specially crafted packet, possibly
resulting in execution of arbitrary code with the privileges of the
process or a Denial of Service condition.
There is no known workaround at this time.
All Quagga users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/quagga-1.0.20160315"