Security Update for Quagga Package - DLA-1152-1
Summary
DLA-1152-1: quagga - security update. Affects quagga versions < 0.99.22.4-1+wheezy3+deb7u2. Fixed in 0.99.22.4-1+wheezy3+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quagga is a routing suite that provides various routing protocols for Unix-like operating systems. It is designed to be a scalable and modular routing software that can be used in a wide range of network environments. The Quagga package includes several daemons, including bgpd, which is responsible for handling Border Gateway Protocol (BGP) routing updates. BGP is a critical protocol used for exchanging routing information between autonomous systems on the internet. The vulnerability in the bgpd daemon could lead to network connectivity issues and potential loss of connectivity.
Vulnerability Detail
The vulnerability in the Quagga bgpd daemon arises from an improper calculation of the length of multi-segment AS_PATH UPDATE messages. This miscalculation can cause the bgpd daemon to drop a session, resulting in a loss of network connectivity. An attacker could potentially exploit this vulnerability to disrupt network operations or launch denial-of-service attacks. The vulnerability affects Quagga versions prior to 0.99.22.4-1+wheezy3+deb7u2 on Debian 7 Wheezy.
How To Fix
Minimum fixed version
0.99.22.4-1+wheezy3+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade quaggaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Quagga package, specifically the bgpd daemon, is vulnerable to a network connectivity issue due to an improper calculation of the length of multi-segment AS_PATH UPDATE messages. To mitigate this vulnerability, it is crucial to upgrade the Quagga package to version 0.99.22.4-1+wheezy3+deb7u2 or later. This will ensure that the bgpd daemon handles routing updates correctly and maintains network connectivity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for quagga →
FAQ
Quagga is a routing suite that provides various routing protocols for Unix-like operating systems. It is commonly used in network environments to handle routing and exchange routing information between autonomous systems.
The bgpd daemon is a component of the Quagga routing suite responsible for handling Border Gateway Protocol (BGP) routing updates. BGP is a critical protocol used for exchanging routing information between autonomous systems on the internet.
The vulnerability in the Quagga bgpd daemon can result in a loss of network connectivity. If exploited, an attacker could disrupt network operations or launch denial-of-service attacks.
The vulnerability affects Quagga versions prior to 0.99.22.4-1+wheezy3+deb7u2 on Debian 7 Wheezy.
To fix this vulnerability, you should upgrade the Quagga package to version 0.99.22.4-1+wheezy3+deb7u2 or later. This can be done by updating the package using the package manager of the Debian 7 Wheezy system.
Related vulnerabilities
Recent vulnerabilities recorded for quagga.
