Ubuntu 12.04 LTS: USN-1441-1 Moderate Patch for Quagga DoS Issue

ubuntu

May 15, 2012

Quagga could be made to crash if it received specially crafted network traffic.

Summary

Quagga could be made to crash if it received specially crafted network

traffic.

Software Description:

- quagga: BGP/OSPF/RIP routing daemon

Details:

It was discovered that Quagga incorrectly handled Link State Update

messages with invalid lengths. A remote attacker could use this flaw to

cause Quagga to crash, resulting in a denial of service. (CVE-2012-0249,

CVE-2012-0250)

It was discovered that Quagga incorrectly handled messages with a malformed

Four-octet AS Number Capability. A remote attacker could use this flaw to

cause Quagga to crash, resulting in a denial of service. (CVE-2012-0255)

Topics Covered

security advisory denial of service quagga ubuntu service interruption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  quagga                          0.99.20.1-0ubuntu0.12.04.2

Ubuntu 11.10:
  quagga                          0.99.20.1-0ubuntu0.11.10.2

Ubuntu 11.04:
  quagga                          0.99.20.1-0ubuntu0.11.04.2

Ubuntu 10.04 LTS:
  quagga                          0.99.20.1-0ubuntu0.10.04.2

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Quagga to make
all the necessary changes.