Bug 738400 (CVE-2011-3327)

Summary: CVE-2011-3327 Quagga (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asersen, jskala, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20110926,reported=20110914,source=cert,cvss2=5.4/AV:A/AC:M/Au:N/C:P/I:P/A:P,rhel-4/quagga=affected,rhel-5/quagga=affected,rhel-6/quagga=affected,fedora-all/quagga=affected,cwe=CWE-122[auto]
Fixed In Version: quagga 0.99.19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-09-13 12:45:32 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 741343, 845163, 845526, 845528, 845529    
Bug Blocks: 738408    
Attachments:
Description Flags
Upstream CVE-2011-3327 patch for Quagga-master branch none

Description Jan Lieskovsky 2011-09-14 13:41:25 EDT
A heap-based buffer overflow flaw was found in the way bgpd daemon of the Quagga routing suite processed BGP UPDATE messages containing unknown AS_PATH in Extended Communities Path Attribute. A configured BGP peer could use this flaw to cause the master BGP daemon (bgpd) to crash, or, potentially execute arbitrary code with the privileges of the user running bgpd.
Comment 1 Jan Lieskovsky 2011-09-14 13:42:53 EDT
This issue affects the versions of the quagga package, as shipped with Red Hat
Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the quagga package, as shipped with Fedora
release of 14 and 15.
Comment 3 Jan Lieskovsky 2011-09-14 13:47:07 EDT
Created attachment 523215 [details]
Upstream CVE-2011-3327 patch for Quagga-master branch
Comment 5 Jan Lieskovsky 2011-09-26 12:03:04 EDT
Public now via:
[1] https://www.cert.fi/en/reports/2011/vulnerability539178.html
Comment 6 Jan Lieskovsky 2011-09-26 12:08:05 EDT
Created quagga tracking bugs for this issue

Affects: fedora-all [bug 741343]
Comment 7 Fedora Update System 2011-10-18 18:16:05 EDT
quagga-0.99.20-2.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2011-10-18 18:20:18 EDT
quagga-0.99.20-2.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2011-10-19 00:40:02 EDT
quagga-0.99.20-2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2012-09-12 16:05:46 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1259 https://rhn.redhat.com/errata/RHSA-2012-1259.html
Comment 14 errata-xmlrpc 2012-09-12 16:06:24 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1258 https://rhn.redhat.com/errata/RHSA-2012-1258.html
Comment 15 Murray McAllister 2012-09-12 22:49:16 EDT
Acknowledgements:

Red Hat would like to thank CERT-FI for reporting this issue. CERT-FI acknowledges Riku Hietamäki, Tuomo Untinen and Jukka Taimisto of the Codenomicon CROSS project as the original reporters.