Test ID:	1.3.6.1.4.1.25623.1.0.70405
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2316-1)
Summary:	The remote host is missing an update for the Debian 'quagga' package(s) announced via the DSA-2316-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'quagga' package(s) announced via the DSA-2316-1 advisory. Vulnerability Insight: Riku Hietamaki, Tuomo Untinen and Jukka Taimisto discovered several vulnerabilities in Quagga, an Internet routing daemon: CVE-2011-3323 A stack-based buffer overflow while decoding Link State Update packets with a malformed Inter Area Prefix LSA can cause the ospf6d process to crash or (potentially) execute arbitrary code. CVE-2011-3324 The ospf6d process can crash while processing a Database Description packet with a crafted Link-State-Advertisement. CVE-2011-3325 The ospfd process can crash while processing a crafted Hello packet. CVE-2011-3326 The ospfd process crashes while processing Link-State-Advertisements of a type not known to Quagga. CVE-2011-3327 A heap-based buffer overflow while processing BGP UPDATE messages containing an Extended Communities path attribute can cause the bgpd process to crash or (potentially) execute arbitrary code. The OSPF-related vulnerabilities require that potential attackers send packets to a vulnerable Quagga router, the packets are not distributed over OSPF. In contrast, the BGP UPDATE messages could be propagated by some routers. For the oldstable distribution (lenny), these problems have been fixed in version 0.99.10-1lenny6. For the stable distribution (squeeze), these problems have been fixed in version 0.99.17-2+squeeze3. For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 0.99.19-1. We recommend that you upgrade your quagga packages. Affected Software/OS: 'quagga' package(s) on Debian 5, Debian 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-3323 CERT/CC vulnerability note: VU#668534 http://www.kb.cert.org/vuls/id/668534 Debian Security Information: DSA-2316 (Google Search) http://www.debian.org/security/2011/dsa-2316 http://security.gentoo.org/glsa/glsa-201202-02.xml https://www.cert.fi/en/reports/2011/vulnerability539178.html RedHat Security Advisories: RHSA-2012:1258 http://rhn.redhat.com/errata/RHSA-2012-1258.html RedHat Security Advisories: RHSA-2012:1259 http://rhn.redhat.com/errata/RHSA-2012-1259.html http://secunia.com/advisories/46139 http://secunia.com/advisories/46274 http://secunia.com/advisories/48106 SuSE Security Announcement: SUSE-SU-2011:1075 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00027.html SuSE Security Announcement: SUSE-SU-2011:1171 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00010.html SuSE Security Announcement: SUSE-SU-2011:1316 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html SuSE Security Announcement: openSUSE-SU-2011:1155 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00007.html Common Vulnerability Exposure (CVE) ID: CVE-2011-3324 Common Vulnerability Exposure (CVE) ID: CVE-2011-3325 Common Vulnerability Exposure (CVE) ID: CVE-2011-3326 Common Vulnerability Exposure (CVE) ID: CVE-2011-3327
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.