[USN-461-1] Quagga vulnerability

[Kees Cook]

=========================================================== 
Ubuntu Security Notice USN-461-1               May 17, 2007
quagga vulnerability
CVE-2007-1995
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  quagga                                   0.99.2-1ubuntu3.1

Ubuntu 6.10:
  quagga                                   0.99.4-4ubuntu1.1

Ubuntu 7.04:
  quagga                                   0.99.6-2ubuntu3.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that Quagga did not correctly verify length 
information sent from configured peers.  Remote malicious peers could 
send a specially crafted UPDATE message which would cause bgpd to abort, 
leading to a denial of service.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1.diff.gz
      Size/MD5:    31906 040e4fc7aceb2e2aa030086d619162dc
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1.dsc
      Size/MD5:      762 f891a5b866522b3d748e66de9d242ffb
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2.orig.tar.gz
      Size/MD5:  2185137 88087d90697fcf5fe192352634f340b3

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.2-1ubuntu3.1_all.deb
      Size/MD5:   663694 bf76e66aff39c9b91dd5e4def6a59b06

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1_amd64.deb
      Size/MD5:  1403368 cc3e45625001b0f1a3a6b1263d26cd1b

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1_i386.deb
      Size/MD5:  1198576 096b5b4bdf88c9d26d166b73930084bf

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1_powerpc.deb
      Size/MD5:  1351228 237c96d9f7237843cdd8e9b88673eb14

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.2-1ubuntu3.1_sparc.deb
      Size/MD5:  1322256 1772df6aa3a48bffed70b57b0812763f

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1.diff.gz
      Size/MD5:    29987 d1cd101f3729161fc0b4c86c6023f82f
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1.dsc
      Size/MD5:      762 4afe7890ba2c178777089bfa9de81534
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4.orig.tar.gz
      Size/MD5:  2207774 a75d3f5ed0b3354274c28d195e3f6479

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.4-4ubuntu1.1_all.deb
      Size/MD5:   706328 b47bf93109b4c5365aab5a2774d4674b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1_amd64.deb
      Size/MD5:  1409208 5ebc2a4f27407f05b3779c2dce6bab03

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1_i386.deb
      Size/MD5:  1244392 1ab4d693a5dc869eb2f1b234451ed2c8

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1_powerpc.deb
      Size/MD5:  1375444 91e3aaccf2ef113ebd55e1b7cf8680e0

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.4-4ubuntu1.1_sparc.deb
      Size/MD5:  1342382 c3b394ce9fffc99d5167dcfefdedacf0

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1.diff.gz
      Size/MD5:    48290 868fad25987463f3373b8e3a7baa6d8c
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1.dsc
      Size/MD5:      861 fde685263db0edc6ef32c0c0081097dd
    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6.orig.tar.gz
      Size/MD5:  2324051 78137ecaa66ff4c3780bd05f60e51cf5

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga-doc_0.99.6-2ubuntu3.1_all.deb
      Size/MD5:   720644 707acb63b8a1cabfa38d7748f834f814

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1_amd64.deb
      Size/MD5:  1476654 91bc4654c0e615b55a88de93c19de2ec

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1_i386.deb
      Size/MD5:  1309546 3c99a46e8d40ef40dd4ee1bc218e6b8e

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1_powerpc.deb
      Size/MD5:  1485312 803b3da7540d5b0c0287ae9f0068b2e0

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/q/quagga/quagga_0.99.6-2ubuntu3.1_sparc.deb
      Size/MD5:  1417036 14443669e7396b193ef9f2d76778bc86

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20070517/e438a02e/attachment.sig>