Sign-up

ID

VAR-201110-0450


CVE

CVE-2011-3323


TITLE

Multiple Quagga remote component vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#668534

DESCRIPTION

The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length. Quagga contains five remote component vulnerabilities due to issues when handling BGP, OSPF, and OSPFv3 packets. A buffer overflow vulnerability 2. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Quagga users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/quagga-0.99.20 " References ========== [ 1 ] CVE-2010-1674 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1674 [ 2 ] CVE-2010-1675 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1675 [ 3 ] CVE-2010-2948 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2948 [ 4 ] CVE-2010-2949 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2949 [ 5 ] CVE-2011-3323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3323 [ 6 ] CVE-2011-3324 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3324 [ 7 ] CVE-2011-3325 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3325 [ 8 ] CVE-2011-3326 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3326 [ 9 ] CVE-2011-3327 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3327 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201202-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-1261-1 November 14, 2011 quagga vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: Quagga could be made to crash or run programs if it received specially crafted network traffic. (CVE-2011-3323) Riku Hietamäki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled certain IPv6 Database Description messages. (CVE-2011-3324) Riku Hietamäki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled certain IPv4 packets. (CVE-2011-3325) Riku Hietamäki, Tuomo Untinen and Jukka Taimisto discovered that Quagga incorrectly handled invalid Link State Advertisement (LSA) types. (CVE-2011-3327) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: quagga 0.99.18-2ubuntu0.1 Ubuntu 11.04: quagga 0.99.17-4ubuntu1.1 Ubuntu 10.10: quagga 0.99.17-1ubuntu0.2 Ubuntu 10.04 LTS: quagga 0.99.15-1ubuntu0.3 In general, a standard system update will make all the necessary changes. CVE-2011-3324 The ospf6d process can crash while processing a Database Description packet with a crafted Link-State-Advertisement. CVE-2011-3325 The ospfd process can crash while processing a crafted Hello packet. CVE-2011-3326 The ospfd process crashes while processing Link-State-Advertisements of a type not known to Quagga. The OSPF-related vulnerabilities require that potential attackers send packets to a vulnerable Quagga router; the packets are not distributed over OSPF. For the oldstable distribution (lenny), these problems have been fixed in version 0.99.10-1lenny6. For the stable distribution (squeeze), these problems have been fixed in version 0.99.17-2+squeeze3. For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 0.99.19-1. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: quagga security update Advisory ID: RHSA-2012:1259-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-1259.html Issue date: 2012-09-12 CVE Names: CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327 CVE-2012-0249 CVE-2012-0250 CVE-2012-0255 CVE-2012-1820 ===================================================================== 1. Summary: Updated quagga packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP (Border Gateway Protocol) routing protocol. The Quagga ospfd and ospf6d daemons implement the OSPF (Open Shortest Path First) routing protocol. A heap-based buffer overflow flaw was found in the way the bgpd daemon processed malformed Extended Communities path attributes. An attacker could send a specially-crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd. The UPDATE message would have to arrive from an explicitly configured BGP peer, but could have originated elsewhere in the BGP network. (CVE-2011-3327) A stack-based buffer overflow flaw was found in the way the ospf6d daemon processed malformed Link State Update packets. An OSPF router could use this flaw to crash ospf6d on an adjacent router. (CVE-2011-3323) A flaw was found in the way the ospf6d daemon processed malformed link state advertisements. An OSPF neighbor could use this flaw to crash ospf6d on a target system. (CVE-2011-3324) A flaw was found in the way the ospfd daemon processed malformed Hello packets. An OSPF neighbor could use this flaw to crash ospfd on a target system. (CVE-2011-3325) A flaw was found in the way the ospfd daemon processed malformed link state advertisements. An OSPF router in the autonomous system could use this flaw to crash ospfd on a target system. (CVE-2011-3326) An assertion failure was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to cause ospfd on an adjacent router to abort. (CVE-2012-0249) A buffer overflow flaw was found in the way the ospfd daemon processed certain Link State Update packets. An OSPF router could use this flaw to crash ospfd on an adjacent router. (CVE-2012-0250) Two flaws were found in the way the bgpd daemon processed certain BGP OPEN messages. A configured BGP peer could cause bgpd on a target system to abort via a specially-crafted BGP OPEN message. (CVE-2012-0255, CVE-2012-1820) Red Hat would like to thank CERT-FI for reporting CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326; and the CERT/CC for reporting CVE-2012-0249, CVE-2012-0250, CVE-2012-0255, and CVE-2012-1820. CERT-FI acknowledges Riku Hietamäki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters of CVE-2011-3327, CVE-2011-3323, CVE-2011-3324, CVE-2011-3325, and CVE-2011-3326. The CERT/CC acknowledges Martin Winter at OpenSourceRouting.org as the original reporter of CVE-2012-0249, CVE-2012-0250, and CVE-2012-0255, and Denis Ovsienko as the original reporter of CVE-2012-1820. Users of quagga should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the bgpd, ospfd, and ospf6d daemons will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Package List: Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/quagga-0.99.15-7.el6_3.2.src.rpm i386: quagga-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm ppc64: quagga-0.99.15-7.el6_3.2.ppc64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.ppc64.rpm s390x: quagga-0.99.15-7.el6_3.2.s390x.rpm quagga-debuginfo-0.99.15-7.el6_3.2.s390x.rpm x86_64: quagga-0.99.15-7.el6_3.2.x86_64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/quagga-0.99.15-7.el6_3.2.src.rpm i386: quagga-contrib-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm quagga-devel-0.99.15-7.el6_3.2.i686.rpm ppc64: quagga-contrib-0.99.15-7.el6_3.2.ppc64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.ppc.rpm quagga-debuginfo-0.99.15-7.el6_3.2.ppc64.rpm quagga-devel-0.99.15-7.el6_3.2.ppc.rpm quagga-devel-0.99.15-7.el6_3.2.ppc64.rpm s390x: quagga-contrib-0.99.15-7.el6_3.2.s390x.rpm quagga-debuginfo-0.99.15-7.el6_3.2.s390.rpm quagga-debuginfo-0.99.15-7.el6_3.2.s390x.rpm quagga-devel-0.99.15-7.el6_3.2.s390.rpm quagga-devel-0.99.15-7.el6_3.2.s390x.rpm x86_64: quagga-contrib-0.99.15-7.el6_3.2.x86_64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.x86_64.rpm quagga-devel-0.99.15-7.el6_3.2.i686.rpm quagga-devel-0.99.15-7.el6_3.2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/quagga-0.99.15-7.el6_3.2.src.rpm i386: quagga-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm x86_64: quagga-0.99.15-7.el6_3.2.x86_64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/quagga-0.99.15-7.el6_3.2.src.rpm i386: quagga-contrib-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm quagga-devel-0.99.15-7.el6_3.2.i686.rpm x86_64: quagga-contrib-0.99.15-7.el6_3.2.x86_64.rpm quagga-debuginfo-0.99.15-7.el6_3.2.i686.rpm quagga-debuginfo-0.99.15-7.el6_3.2.x86_64.rpm quagga-devel-0.99.15-7.el6_3.2.i686.rpm quagga-devel-0.99.15-7.el6_3.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-3323.html https://www.redhat.com/security/data/cve/CVE-2011-3324.html https://www.redhat.com/security/data/cve/CVE-2011-3325.html https://www.redhat.com/security/data/cve/CVE-2011-3326.html https://www.redhat.com/security/data/cve/CVE-2011-3327.html https://www.redhat.com/security/data/cve/CVE-2012-0249.html https://www.redhat.com/security/data/cve/CVE-2012-0250.html https://www.redhat.com/security/data/cve/CVE-2012-0255.html https://www.redhat.com/security/data/cve/CVE-2012-1820.html https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQUOxMXlSAg2UNWIIRAspnAKDCd5umtQIWFZYD8vyRPpCkAlgiwwCglw+g P4VSjxs4xRnVCtT/IOkBkKQ= =VtuC -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 3.06

sources: NVD: CVE-2011-3323 // CERT/CC: VU#668534 // JVNDB: JVNDB-2011-002368 // BID: 49784 // PACKETSTORM: 110033 // PACKETSTORM: 107001 // PACKETSTORM: 105571 // PACKETSTORM: 116468 // PACKETSTORM: 116469

AFFECTED PRODUCTS

vendor:quaggamodel:quaggascope:eqversion:0.99.15

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.11

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.16

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.13

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.14

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.9

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.10

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.17

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.12

Trust: 1.6

vendor:quaggamodel:quaggascope:eqversion:0.99.8

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.0

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.1

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.4

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96.3

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96.4

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.2

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.5

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.3

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.5

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96.5

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.2

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96.1

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.95

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.5

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.3

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.4

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.96.2

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.1

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.3

Trust: 1.0

vendor:quaggamodel:quaggascope:lteversion:0.99.18

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.7

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.6

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.2

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.97.1

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.4

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.99.6

Trust: 1.0

vendor:quaggamodel:quaggascope:eqversion:0.98.0

Trust: 1.0

vendor:debian gnu linuxmodel: - scope: - version: -

Trust: 0.8

vendor:red hatmodel: - scope: - version: -

Trust: 0.8

vendor:quaggamodel:quaggascope:ltversion:0.99.19

Trust: 0.8

vendor:internet initiativemodel:seil/b1scope:ltversion:1.00 from 3.41

Trust: 0.8

vendor:internet initiativemodel:seil/neu 2fe plusscope:ltversion:1.00 from 2.13

Trust: 0.8

vendor:internet initiativemodel:seil/turboscope:ltversion:1.00 from 2.13

Trust: 0.8

vendor:internet initiativemodel:seil/x1scope:ltversion:1.00 from 3.41

Trust: 0.8

vendor:internet initiativemodel:seil/x2scope:ltversion:1.00 from 3.41

Trust: 0.8

vendor:internet initiativemodel:seil/x86scope:ltversion:1.70 from 1.91

Trust: 0.8

vendor:quaggamodel:quaggascope:eqversion:0.99.18

Trust: 0.6

vendor:ubuntumodel:linux i386scope:eqversion:11.10

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.10

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:11.04

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:11.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:11.04

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:11.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:susemodel:linux enterprise server for vmware sp1scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp1scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise server sp4scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise server sp3scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise server sp2scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp1scope:eqversion:11

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp4scope:eqversion:10

Trust: 0.3

vendor:susemodel:linux enterprise sdk sp3scope:eqversion:10

Trust: 0.3

vendor:susemodel:opensusescope:eqversion:11.4

Trust: 0.3

vendor:susemodel:opensusescope:eqversion:11.3

Trust: 0.3

vendor:redhatmodel:enterprise linux desktop workstation clientscope:eqversion:5

Trust: 0.3

vendor:redmodel:hat enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:redmodel:hat enterprise linux desktop clientscope:eqversion:5

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.17

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.16

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.15

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.11

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.9

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.8

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.7

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.6

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.5

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.4

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.3

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.2

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.99.1

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.98.6

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.98.5

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.98.3

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.97.3

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.96.4

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.96.3

Trust: 0.3

vendor:quaggamodel:routing software suitescope:eqversion:0.96.2

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6.2

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:quaggamodel:routing software suitescope:neversion:0.99.19

Trust: 0.3

sources: CERT/CC: VU#668534 // BID: 49784 // JVNDB: JVNDB-2011-002368 // CNNVD: CNNVD-201109-583 // NVD: CVE-2011-3323

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-3323
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#668534
value: 15.69

Trust: 0.8

NVD: CVE-2011-3323
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201109-583
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2011-3323
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: CERT/CC: VU#668534 // JVNDB: JVNDB-2011-002368 // CNNVD: CNNVD-201109-583 // NVD: CVE-2011-3323

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.8

sources: JVNDB: JVNDB-2011-002368 // NVD: CVE-2011-3323

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 110033 // PACKETSTORM: 107001 // CNNVD: CNNVD-201109-583

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201109-583

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-002368

PATCH
title:Top Pageurl:http://www.quagga.net/
Trust: 0.8
title:ospf6d: CVE-2011-3323url:http://code.quagga.net/?p=quagga.git;a=commit;h=abc7ef44ca05493500865ce81f7b84f5c4eb6594
Trust: 0.8
title:quagga-0.99.19.changelogurl:http://www.quagga.net/download/quagga-0.99.19.changelog.txt
Trust: 0.8
title:RHSA-2012:1259url:http://rhn.redhat.com/errata/RHSA-2012-1259.html
Trust: 0.8
title:Multiple Denial of Service vulnerabilities in Quaggaurl:https://blogs.oracle.com/sunsecurity/entry/multiple_denial_of_service_vulnerabilities5
Trust: 0.8
title:偽装されたOSPF（v2,v3）パケットに対する受信処理の脆弱性url:http://www.seil.jp/support/security/a01141.html
Trust: 0.8
title:quagga-0.99.19url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=40714
Trust: 0.6
title:quagga-master-513254url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=40715
Trust: 0.6
title:quagga.git-94431dbc753171b48b5c6806af97fd690813b00aurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=40713
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2011-002368 // 
            
            
            
            CNNVD: CNNVD-201109-583

EXTERNAL IDS
db:NVDid:CVE-2011-3323
Trust: 3.2
db:CERT/CCid:VU#668534
Trust: 2.9
db:SECUNIAid:46139
Trust: 1.6
db:SECUNIAid:46274
Trust: 1.0
db:SECUNIAid:48106
Trust: 1.0
db:JVNDBid:JVNDB-2011-002368
Trust: 0.8
db:CNNVDid:CNNVD-201109-583
Trust: 0.6
db:BIDid:49784
Trust: 0.3
db:PACKETSTORMid:110033
Trust: 0.1
db:PACKETSTORMid:107001
Trust: 0.1
db:PACKETSTORMid:105571
Trust: 0.1
db:PACKETSTORMid:116468
Trust: 0.1
db:PACKETSTORMid:116469
Trust: 0.1
sources:
            
            
            CERT/CC: VU#668534 // 
            
            
            
            BID: 49784 // 
            
            
            
            JVNDB: JVNDB-2011-002368 // 
            
            
            
            PACKETSTORM: 110033 // 
            
            
            
            PACKETSTORM: 107001 // 
            
            
            
            PACKETSTORM: 105571 // 
            
            
            
            PACKETSTORM: 116468 // 
            
            
            
            PACKETSTORM: 116469 // 
            
            
            
            CNNVD: CNNVD-201109-583 // 
            
            
            
            NVD: CVE-2011-3323

REFERENCES
url:https://www.cert.fi/en/reports/2011/vulnerability539178.html
Trust: 2.7
url:http://www.kb.cert.org/vuls/id/668534
Trust: 2.1
url:http://www.quagga.net/download/quagga-0.99.19.changelog.txt
Trust: 1.6
url:http://secunia.com/advisories/46139
Trust: 1.6
url:http://rhn.redhat.com/errata/rhsa-2012-1258.html
Trust: 1.4
url:http://rhn.redhat.com/errata/rhsa-2012-1259.html
Trust: 1.4
url:http://security.gentoo.org/glsa/glsa-201202-02.xml
Trust: 1.1
url:http://code.quagga.net/?p=quagga.git%3ba=commit%3bh=abc7ef44ca05493500865ce81f7b84f5c4eb6594
Trust: 1.0
url:http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html
Trust: 1.0
url:http://www.debian.org/security/2011/dsa-2316
Trust: 1.0
url:http://secunia.com/advisories/46274
Trust: 1.0
url:http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html
Trust: 1.0
url:http://secunia.com/advisories/48106
Trust: 1.0
url:http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html
Trust: 1.0
url:http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00010.html
Trust: 1.0
url:about vulnerability notes
Trust: 0.8
url:contact us about this vulnerability
Trust: 0.8
url:provide a vendor statement
Trust: 0.8
url:https://bugzilla.redhat.com/show_bug.cgi?id=cve-2011-3327
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-3323
Trust: 0.8
url:http://jvn.jp/cert/jvnvu668534
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-3323
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2011-3323
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2011-3326
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2011-3325
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2011-3324
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2011-3327
Trust: 0.5
url:http://www.quagga.net/news2.php?y=2011&m=9&d=26#id1285509600
Trust: 0.3
url:http://www.quagga.net/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2010-1674
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2011-3323.html
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2012-0250
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2011-3325.html
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2011-3324.html
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2012-0249
Trust: 0.2
url:https://access.redhat.com/security/team/contact/
Trust: 0.2
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2012-0249.html
Trust: 0.2
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2012-0250.html
Trust: 0.2
url:https://access.redhat.com/knowledge/articles/11258
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2011-3326.html
Trust: 0.2
url:https://access.redhat.com/security/team/key/#package
Trust: 0.2
url:https://www.redhat.com/security/data/cve/cve-2011-3327.html
Trust: 0.2
url:http://bugzilla.redhat.com/):
Trust: 0.2
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1674
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-2949
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3325
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3324
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-1675
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-2948
Trust: 0.1
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:http://security.gentoo.org/
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3326
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3327
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-3323
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-2948
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-2949
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-1675
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/quagga/0.99.17-4ubuntu1.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/quagga/0.99.15-1ubuntu0.3
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/quagga/0.99.18-2ubuntu0.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/quagga/0.99.17-1ubuntu0.2
Trust: 0.1
url:http://www.ubuntu.com/usn/usn-1261-1
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:http://www.debian.org/security/faq
Trust: 0.1
url:http://www.debian.org/security/
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:https://www.redhat.com/security/data/cve/cve-2010-1674.html
Trust: 0.1
url:https://www.redhat.com/security/data/cve/cve-2012-0255.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-0255
Trust: 0.1
url:https://www.redhat.com/security/data/cve/cve-2012-1820.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-1820
Trust: 0.1
sources:
            
            
            CERT/CC: VU#668534 // 
            
            
            
            BID: 49784 // 
            
            
            
            JVNDB: JVNDB-2011-002368 // 
            
            
            
            PACKETSTORM: 110033 // 
            
            
            
            PACKETSTORM: 107001 // 
            
            
            
            PACKETSTORM: 105571 // 
            
            
            
            PACKETSTORM: 116468 // 
            
            
            
            PACKETSTORM: 116469 // 
            
            
            
            CNNVD: CNNVD-201109-583 // 
            
            
            
            NVD: CVE-2011-3323

CREDITS
Riku Hietam&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;auml;ki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project
Trust: 0.3
sources:
            
            
            BID: 49784

SOURCES
db:CERT/CCid:VU#668534
db:BIDid:49784
db:JVNDBid:JVNDB-2011-002368
db:PACKETSTORMid:110033
db:PACKETSTORMid:107001
db:PACKETSTORMid:105571
db:PACKETSTORMid:116468
db:PACKETSTORMid:116469
db:CNNVDid:CNNVD-201109-583
db:NVDid:CVE-2011-3323

LAST UPDATE DATE
2024-11-23T19:34:48.845000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#668534date:2011-10-06T00:00:00
db:BIDid:49784date:2015-04-13T21:15:00
db:JVNDBid:JVNDB-2011-002368date:2012-11-13T00:00:00
db:CNNVDid:CNNVD-201109-583date:2011-09-29T00:00:00
db:NVDid:CVE-2011-3323date:2024-11-21T01:30:15.803

SOURCES RELEASE DATE
db:CERT/CCid:VU#668534date:2011-09-26T00:00:00
db:BIDid:49784date:2011-09-26T00:00:00
db:JVNDBid:JVNDB-2011-002368date:2011-10-14T00:00:00
db:PACKETSTORMid:110033date:2012-02-22T02:10:03
db:PACKETSTORMid:107001date:2011-11-15T15:35:22
db:PACKETSTORMid:105571date:2011-10-05T23:00:08
db:PACKETSTORMid:116468date:2012-09-12T23:06:05
db:PACKETSTORMid:116469date:2012-09-12T23:06:22
db:CNNVDid:CNNVD-201109-583date:2011-09-29T00:00:00
db:NVDid:CVE-2011-3323date:2011-10-10T10:55:06.270