Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635858 (CVE-2017-16227) - <net-misc/quagga-1.2.2: remote denial of service via BGP UPDATE messages
Summary: <net-misc/quagga-1.2.2: remote denial of service via BGP UPDATE messages
Status: RESOLVED FIXED
Alias: CVE-2017-16227
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: C3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-30 00:41 UTC by Aleksandr Wagner (Kivak)
Modified: 2018-02-20 11:22 UTC (History)
1 user (show)

See Also:
Package list:
=net-misc/quagga-1.2.2
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-10-30 00:41:59 UTC 
CVE-2017-16227 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16227):

The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message. 

References:

http://download.savannah.gnu.org/releases/quagga/quagga-1.2.2.changelog.txt
https://bugs.debian.org/879474
https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=7a42b78be9a4108d98833069a88e6fddb9285008
https://lists.quagga.net/pipermail/quagga-dev/2017-September/033284.html
Comment 1 Sergey Popov (RETIRED) gentoo-dev 2017-11-30 10:19:45 UTC 
commit 8b52a9fcb08c6ad23d8e0c664bdad11ce9765ca5
Author: Sergey Popov <pinkbyte@gentoo.org>
Date:   Thu Nov 30 12:14:26 2017 +0300

    net-misc/quagga: version bump

    Remove obsolete ospfapi configure options

    Gentoo-Bug: 635858
    Gentoo-Bug: 638892
    Package-Manager: Portage-2.3.16, Repoman-2.3.6

Arches, please test and mark stable =net-misc/quagga-1.2.2

Target keywords: alpha amd64 arm hppa ppc x86
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2017-11-30 19:06:19 UTC 
x86 stable
Comment 3 Agostino Sarubbo gentoo-dev 2017-12-01 11:21:00 UTC 
amd64 stable
Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev 2017-12-04 22:09:58 UTC 
hppa stable (thanks to Rolf Eike Beer)
Comment 5 Markus Meier gentoo-dev 2017-12-12 18:39:36 UTC 
arm stable
Comment 6 Aaron Bauman (RETIRED) gentoo-dev 2018-01-21 23:53:12 UTC 
sparc is no longer a stable arch and test failures do not block security bugs.

@arches, please finish stabilizing.
Comment 7 Tobias Klausmann (RETIRED) gentoo-dev 2018-01-28 18:23:52 UTC 
Stable on alpha.
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2018-02-07 19:51:20 UTC 
sparc did 1.2.2-r1
Comment 9 Aaron Bauman (RETIRED) gentoo-dev 2018-02-07 23:20:45 UTC 
@ppc, ping.
Comment 10 Sergey Popov (RETIRED) gentoo-dev 2018-02-20 11:22:36 UTC 
ppc stable

Last arch, no glsa, closing