USN-775-2: Quagga regression

Ubuntu Security Notice USN-775-2

9th June, 2009

quagga regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 8.10
  • Ubuntu 8.04 LTS
  • Ubuntu 6.06 LTS

Software description

  • quagga

Details

USN-775-1 fixed vulnerabilities in Quagga. The preventative fixes
introduced in Quagga prior to Ubuntu 9.04 could result in BGP service
failures. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that the BGP service in Quagga did not correctly
handle certain AS paths containing 4-byte ASNs. An authenticated remote
attacker could exploit this flaw to cause bgpd to abort, leading to a
denial of service.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 8.10:
quagga 0.99.9-6ubuntu0.2
Ubuntu 8.04 LTS:
quagga 0.99.9-2ubuntu1.3
Ubuntu 6.06 LTS:
quagga 0.99.2-1ubuntu3.6

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

LP: 384193