Security update for quagga SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0457-1 Final 1 1 2018-02-16T02:45:00Z current 2018-02-16T02:45:00Z 2018-02-16T02:45:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for quagga This update for quagga fixes the following issues: - The Quagga BGP daemon contained a bug in the AS_PATH size calculation that could have been exploited to facilitate a remote denial-of-service attack via specially crafted BGP UPDATE messages. [CVE-2017-16227, bsc#1065641] - The Quagga BGP daemon did not check whether data sent to peers via NOTIFY had an invalid attribute length. It was possible to exploit this issue and cause the bgpd process to leak sensitive information over the network to a configured peer. [CVE-2018-5378, bsc#1079798] - The Quagga BGP daemon used to double-free memory when processing certain forms of UPDATE messages. This issue could be exploited by sending an optional/transitive UPDATE attribute that all conforming eBGP speakers should pass along. Consequently, a single UPDATE message could have affected many bgpd processes across a wide area of a network. Through this vulnerability, attackers could potentially have taken over control of affected bgpd processes remotely. [CVE-2018-5379, bsc#1079799] - It was possible to overrun internal BGP code-to-string conversion tables in the Quagga BGP daemon. Configured peers could have exploited this issue and cause bgpd to emit debug and warning messages into the logs that would contained arbitrary bytes. [CVE-2018-5380, bsc#1079800] - The Quagga BGP daemon could have entered an infinite loop if sent an invalid OPEN message by a configured peer. If this issue was exploited, then bgpd would cease to respond to any other events. BGP sessions would have been dropped and not be reestablished. The CLI interface would have been unresponsive. The bgpd daemon would have stayed in this state until restarted. [CVE-2018-5381, bsc#1079801] - The Quagga daemon's telnet 'vty' CLI contains an unbounded memory allocation bug that could be exploited for a denial-of-service attack on the daemon. This issue has been fixed. [CVE-2017-5495, bsc#1021669] - The telnet 'vty' CLI of the Quagga daemon is no longer enabled by default, because the passwords in the default 'zebra.conf' config file are now disabled. The vty interface is available via 'vtysh' utility using pam authentication to permit management access for root without password. [bsc#1021669] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-quagga-13471,sleposp3-quagga-13471,slessp3-quagga-13471,slessp4-quagga-13471 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ Link for SUSE-SU-2018:0457-1 https://lists.opensuse.org/opensuse-security-announce/2018-02/msg00031.html E-Mail link for SUSE-SU-2018:0457-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1021669 SUSE Bug 1021669 https://bugzilla.suse.com/1065641 SUSE Bug 1065641 https://bugzilla.suse.com/1079798 SUSE Bug 1079798 https://bugzilla.suse.com/1079799 SUSE Bug 1079799 https://bugzilla.suse.com/1079800 SUSE Bug 1079800 https://bugzilla.suse.com/1079801 SUSE Bug 1079801 https://www.suse.com/security/cve/CVE-2017-16227/ SUSE CVE CVE-2017-16227 page https://www.suse.com/security/cve/CVE-2017-5495/ SUSE CVE CVE-2017-5495 page https://www.suse.com/security/cve/CVE-2018-5378/ SUSE CVE CVE-2018-5378 page https://www.suse.com/security/cve/CVE-2018-5379/ SUSE CVE CVE-2018-5379 page https://www.suse.com/security/cve/CVE-2018-5380/ SUSE CVE CVE-2018-5380 page https://www.suse.com/security/cve/CVE-2018-5381/ SUSE CVE CVE-2018-5381 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 quagga-0.99.15-0.30.3.1 quagga-devel-0.99.15-0.30.3.1 quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Server 11 SP4 quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 quagga-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 quagga-devel-0.99.15-0.30.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message. CVE-2017-16227 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2017-16227.html CVE-2017-16227 https://bugzilla.suse.com/1065641 SUSE Bug 1065641 All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10. CVE-2017-5495 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2017-5495.html CVE-2017-5495 https://bugzilla.suse.com/1021669 SUSE Bug 1021669 The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash. CVE-2018-5378 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2018-5378.html CVE-2018-5378 https://bugzilla.suse.com/1079798 SUSE Bug 1079798 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. CVE-2018-5379 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2018-5379.html CVE-2018-5379 https://bugzilla.suse.com/1079799 SUSE Bug 1079799 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. CVE-2018-5380 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2018-5380.html CVE-2018-5380 https://bugzilla.suse.com/1079800 SUSE Bug 1079800 The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service. CVE-2018-5381 SUSE Linux Enterprise Point of Sale 11 SP3:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-LTSS:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-0.99.15-0.30.3.1 SUSE Linux Enterprise Software Development Kit 11 SP4:quagga-devel-0.99.15-0.30.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180457-1/ https://www.suse.com/security/cve/CVE-2018-5381.html CVE-2018-5381 https://bugzilla.suse.com/1079801 SUSE Bug 1079801