Stack Overrun Vulnerability in quagga
Summary
DLA-662-1: quagga - security update. Affects quagga versions < 0.99.22.4-1+wheezy3+deb7u1. Fixed in 0.99.22.4-1+wheezy3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quagga is a BGP/OSPF/RIP routing daemon used for managing network routing protocols. It provides a flexible and scalable solution for routing in large networks. The package is widely used in various Linux distributions, including Debian 7 Wheezy. Quagga enables routers to exchange routing information and make informed decisions about the best paths for data packets. However, a vulnerability has been discovered in the IPv6 RA receive code of quagga, which can lead to a stack overrun.
Vulnerability Detail
The vulnerability in quagga arises from a buffer size mismatch in the IPv6 RA receive code. The buffer size specified during the reception of data confuses two constants with different values, resulting in a stack overrun. An attacker could exploit this vulnerability by sending specially crafted IPv6 RA packets to a vulnerable quagga instance. Successful exploitation could lead to arbitrary code execution or a denial of service condition. This vulnerability poses a significant risk to the integrity and availability of affected systems.
How To Fix
Minimum fixed version
0.99.22.4-1+wheezy3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade quaggaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of quagga.
Conclusion
The stack overrun vulnerability in quagga poses a significant risk to the integrity and availability of affected systems. It is recommended to upgrade to the patched version of quagga (0.99.22.4-1+wheezy3+deb7u1 or later) to mitigate this vulnerability. Promptly applying the update will ensure the security and stability of the quagga installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for quagga →
FAQ
Quagga is a BGP/OSPF/RIP routing daemon used for managing network routing protocols. It enables routers to exchange routing information and make informed decisions about the best paths for data packets.
The vulnerability in quagga can be exploited by an attacker to execute arbitrary code or cause a denial of service condition. This can lead to a compromise of the affected system's integrity and availability.
This vulnerability affects quagga installations running on Debian 7 Wheezy.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your quagga installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze and alert you in real-time if any open-source vulnerabilities, including this one, are detected.
No workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of quagga.
Related vulnerabilities
Recent vulnerabilities recorded for quagga.
