|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
Quagga contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a RIPv1 'SEND UPDATE' request is sent to the 'RIPd' service, even when it is configured to support RIPv2 only. This will also happen when the RIPv2-only service is configued to work with MD5 authentication. The vulnerability will disclose the service's RIP routing table, resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version 0.98 release candidate 20060504 or 0.99 release candidate 20060504, respectively, or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by filtering RIPv1 traffic on a need-to-access basis.
|
|
Products |
|
Quagga
 |
0.98.5 |
0.99.3 |
|
|
|
|
|
|
Credit |
- Konstantin V. Gavrilenko - k.gavrilenko
 arhont.com - Arhont Ltd - Information Security
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
