PT-2006-1052 · Quagga+1 · Quagga+1

Konstantin V. Gavrilenko · Published 2006-05-05 · Updated 2018-10-18 · CVE-2006-2224

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Quagga versions prior to 0.98.6-r1 Quagga version 0.99 before 20060503

Description: The issue concerns the RIPd component in Quagga, which fails to properly enforce RIPv2 authentication requirements. This allows remote attackers to modify routing state via RIPv1 RESPONSE packets. Multiple vulnerabilities in the Quagga package can lead to a breach of protected information, and these vulnerabilities can be exploited remotely.

Recommendations: For Quagga versions prior to 0.98.6-r1, update to version 0.98.6-r1 or later to resolve the issue. For Quagga version 0.99 before 20060503, update to a version released after 20060503 to address the problem. As a temporary workaround, consider restricting access to the RIPd component until a patch is available.

Exploit

Fix

RCE

Improper Authentication

Weakness Enumeration

CWE-20

CWE-287

Related Identifiers

BDU:2015-09507

CVE-2006-2224

DSA-1059-1

RHSA-2006:0525

RHSA-2006_0525

Affected Products

Quagga

Red Hat

References · 34

• 🔥 http://securityfocus.com/bid/17808 · Exploit
• 🔥 https://exploit-db.com/exploits/27802 · Exploit
• http://novell.com/linux/security/advisories/2006_17_sr.html · Vendor Advisory
• http://debian.org/security/2006/dsa-1059 · Vendor Advisory
• http://secunia.com/advisories/20421 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0533.html · Vendor Advisory
• http://secunia.com/advisories/20782 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200605-15.xml · Vendor Advisory
• http://secunia.com/advisories/19910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09507 · Security Note
• http://secunia.com/advisories/20137 · Vendor Advisory
• http://bugzilla.quagga.net/show_bug.cgi?id=262 · Patch
• ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2224 · Security Note
• http://secunia.com/advisories/20138 · Vendor Advisory