PT-2011-5219 · Centos+4 · Centos+4
Jukka Taimisto
+2
·
Publicado
1970-01-01
·
Atualizado
2018-01-06
·
CVE-2011-3326
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Quagga versions prior to 0.99.19
Quagga versions prior to 0.99.20
Description
The issue affects the Quagga package in various Linux operating systems, including Red Hat Enterprise Linux, CentOS, SUSE Linux Enterprise, and openSUSE. It allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message. The
ospf flood function in ospf flood.c in ospfd is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information.Recommendations
For Quagga versions prior to 0.99.19, update to version 0.99.19 or later.
For Quagga versions prior to 0.99.20, update to version 0.99.20 or later.
As a temporary workaround, consider disabling the
ospf flood function until a patch is available. Restrict access to the vulnerable ospfd module to minimize the risk of exploitation. Avoid using the ospf flood function in the affected API endpoint until the issue is resolved.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Quagga
Red Hat
Suse Linux Enterprise
Opensuse