Riku Hietamaki

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Vista versions SP1 through SP2 Microsoft Windows Server 2008 versions Gold through R2 Microsoft Windows 7 (affected versions not specified) **Description** A denial of service issue exists due to the way the Server Message Block (SMB) Protocol software handles specially crafted SMB compounded requests. This can be exploited by sending a specially crafted network message to a computer running the Server service, allowing remote attackers to cause a system hang. No authentication is required for an attacker to exploit this issue. **Recommendations** For Microsoft Windows Vista versions SP1 through SP2, apply the recommended patch to resolve the issue. For Microsoft Windows Server 2008 versions Gold through R2, apply the recommended patch to resolve the issue. For Microsoft Windows 7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga versions 0.99.15 and earlier **Description** The issue affects the Quagga package, allowing remote attackers to cause a denial of service via a Link State Update message with an invalid IPv6 prefix length. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later to resolve the issue. For Quagga versions 0.99.15 and earlier, update to a version later than 0.99.15 to mitigate the risk. As a temporary workaround, consider restricting access to the ospf6d implementation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga version 0.99.15 **Description** The issue allows remote attackers to cause a denial of service via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message. This is due to the `ospf6 lsa is changed` function in `ospf6 lsa.c` in the OSPFv3 implementation in `ospf6d`. The vulnerability can lead to disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later to resolve the issue. For Quagga version 0.99.15, update to version 0.99.19 or later to resolve the issue. As a temporary workaround, consider disabling the `ospf6 lsa is changed` function until a patch is available. Restrict access to the `ospf6d` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga versions prior to 0.99.20 **Description** The issue affects the Quagga package in various Linux operating systems, including Red Hat Enterprise Linux, CentOS, SUSE Linux Enterprise, and openSUSE. It allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message. The `ospf flood` function in `ospf flood.c` in `ospfd` is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later. For Quagga versions prior to 0.99.20, update to version 0.99.20 or later. As a temporary workaround, consider disabling the `ospf flood` function until a patch is available. Restrict access to the vulnerable `ospfd` module to minimize the risk of exploitation. Avoid using the `ospf flood` function in the affected API endpoint until the issue is resolved.