|
|
Info |
Last Modified |
| 9 months ago |
|
|
|
|
Description |
Quagga contains a flaw that may allow an unauthenticated attacker to inject RIP routes into the 'RIPd' service. The issue is triggered when the service is configured with MD5 authentication but no specific RIP version in the configuration file. It is then possible to send unauthenticated RIPv1 'RESPONSE' packets that will be accepted by the service, causing a manipulation of the RIP routing table and resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version 0.98 release candidate 20060504 or 0.99 release candidate 20060504, respectively, or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by filtering RIPv1 traffic on a need-to-access basis.
|
|
Products |
|
Quagga
 |
0.98.5 |
0.99.3 |
|
|
|
|
|
|
Credit |
- Konstantin V. Gavrilenko - k.gavrilenko
 arhont.com - Arhont Ltd - Information Security
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
