Quagga contains a flaw that may allow a remote denial of service. The issue is triggered when the AS path limit/TTL functionality encounters an error when parsing some specific AS_PATHLIMIT attributes, allowing a remote attacker to use crafted AS_PATHLIMIT attributes to reset BGP sessions, resulting in a loss of availability.

Upgrade to version 0.99.18 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-1675 (see also: NVD)
• Secunia Advisory ID: 43499 43770 43894 43956 43982 43992 44148 48106
• Bugtraq ID: 46943
• ISS X-Force ID: 66212
• Related OSVDB ID: 71259
• VUPEN Advisory: ADV-2011-0711
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057831.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057833.html
  http://www.gentoo.org/security/en/glsa/glsa-201202-02.xml
  https://bugzilla.redhat.com/show_bug.cgi?id=654614
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-March/001289.html
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html
  http://seclists.org/fulldisclosure/2011/Mar/346
• Vendor Specific Advisory URL: http://www.debian.org/security/2011/dsa-2197
  http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200
  http://www.xerox.com/download/security/security-bulletin/16576-4c596b2a88f00/cert_XRX12-006_v1.01.pdf
  https://hermes.opensuse.org/messages/7786951
  https://hermes.opensuse.org/messages/7789143
  https://hermes.opensuse.org/messages/7795766
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2011:058
• RedHat RHSA: https://rhn.redhat.com/errata/RHSA-2011-0406.html

• Not Available