Bug 654614 (CVE-2010-1675)

Summary:	CVE-2010-1675 quagga: BGP session reset by processing BGP Update message with malformed AS-path attributes
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jskala, jwest, mjc, psklenar, rvokal, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-07-31 19:08:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	684750, 684751, 689852
Bug Blocks:

Description Jan Lieskovsky 2010-11-18 12:09:22 UTC

A security flaw was found in the way Quagga bgpd daemon
processed certain route metrics information. A configured BGP peer
could use this flaw to send a BGP message with specially-crafted
value of AS-path attribute, which would cause the bgpd daemon on
all systems on the route the message travels to reset the BGP session.

Comment 9 Jan Lieskovsky 2011-03-22 16:10:48 UTC

This issue did NOT affect the versions of the quagga package,
as shipped with Red Hat Enterprise Linux 4 and 5, as they
did not include support for AS-Pathlimit feature yet.

--

This issue affects the version of the quagga package, as shipped
with Red Hat Enterprise Linux 6.

--

This issue affects the versions of the quagga package, as shipped
with Fedora release of 13 and 14.

Comment 10 Jan Lieskovsky 2011-03-22 16:14:14 UTC

Updated upstream version, addressing this:

http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200

Comment 11 Jan Lieskovsky 2011-03-22 16:18:19 UTC

Created quagga tracking bugs for this issue

Affects: fedora-all [bug 689852]

Comment 13 errata-xmlrpc 2011-03-31 15:06:11 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0406 https://rhn.redhat.com/errata/RHSA-2011-0406.html