Gentoo has issued an advisory today (October 10): http://www.gentoo.org/security/en/glsa/glsa-201310-08.xml We have already fixed the 2012 CVEs, but the CVE-2013-2236 is new. This issue is fixed upstream in quagga-0.99.22.2, but Fedora fixed it by disabling the vulnerable features (ospfapi and ospfclient), as they don't really provide any useful functionality anyway: http://pkgs.fedoraproject.org/cgit/quagga.git/commit/?id=c17c7f3c42845c0f6d17852a827cd2d71fe74c24 I've disabled those features as well as updating to the newest version in Cauldron in quagga-0.99.22.4-1.mga4. For Mageia 2 and Mageia 3, I have disabled ospfapi and ospfclient. Advisory: ======================== Updated quagga packages fix security vulnerability: Remotely exploitable buffer overflow in ospf_api.c and ospfclient.c when processing LSA messages in quagga before 0.99.22.2 (CVE-2013-2236). Note: We have worked around this vulnerability by disabling the ospf_api and ospfclient features, which did not provide useful functionality. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2236 http://lists.quagga.net/pipermail/quagga-dev/2013-July/010622.html http://www.gentoo.org/security/en/glsa/glsa-201310-08.xml ======================== Updated packages in core/updates_testing: ======================== quagga-0.99.20.1-3.2.mga2 quagga-contrib-0.99.20.1-3.2.mga2 libquagga0-0.99.20.1-3.2.mga2 libquagga-devel-0.99.20.1-3.2.mga2 quagga-0.99.20.1-9.1.mga3 quagga-contrib-0.99.20.1-9.1.mga3 libquagga0-0.99.20.1-9.1.mga3 libquagga-devel-0.99.20.1-9.1.mga3 from SRPMS: quagga-0.99.20.1-3.2.mga2.src.rpm quagga-0.99.20.1-9.1.mga3.src.rpm Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA2TOO
Procedure: https://bugs.mageia.org/show_bug.cgi?id=6512#c1
Whiteboard: MGA2TOO => MGA2TOO has_procedure
Testing complete mga3 64 Quagga displays the same warnings as dropbear, has this been addressed in Cauldron? 1/1: removing quagga-0.99.20.1-9.1.mga3.x86_64 ########################################################################warning: file /etc/rc.d/init.d/zebra: remove failed: No such file or directory warning: file /etc/rc.d/init.d/watchquagga: remove failed: No such file or directory warning: file /etc/rc.d/init.d/ripngd: remove failed: No such file or directory warning: file /etc/rc.d/init.d/ripd: remove failed: No such file or directory warning: file /etc/rc.d/init.d/ospfd: remove failed: No such file or directory warning: file /etc/rc.d/init.d/ospf6d: remove failed: No such file or directory warning: file /etc/rc.d/init.d/bgpd: remove failed: No such file or directory ################################## Note: these are caused by leftover SysV init scripts which are no longer required and are harmless. See bug 11458
Whiteboard: MGA2TOO has_procedure => MGA2TOO has_procedure mga3-64-ok
Testing complete mga2 64 # for name in {bgpd,isisd,ospfd,ospf6d,ripd,ripngd,zebra,watchquagga};do service $name restart; done Restarting bgpd (via systemctl): [ OK ] Restarting isisd (via systemctl): [ OK ] Restarting ospfd (via systemctl): [ OK ] Restarting ospf6d (via systemctl): [ OK ] Restarting ripd (via systemctl): [ OK ] Restarting ripngd (via systemctl): [ OK ] Restarting zebra (via systemctl): [ OK ] Restarting watchquagga (via systemctl): [ OK ] # tail /var/log/syslog Oct 15 11:16:42 mga264 watchquagga[9945]: watchquagga 0.99.20.1 watching [zebra bgpd ospfd ospf6d ripd ripngd], mode [monitor] Oct 15 11:16:42 mga264 watchquagga[9937]: Starting watchquagga: [ OK ] Oct 15 11:16:42 mga264 watchquagga[9945]: ospf6d state -> up : connect succeeded Oct 15 11:16:42 mga264 watchquagga[9945]: zebra state -> up : connect succeeded Oct 15 11:16:42 mga264 watchquagga[9945]: ripd state -> up : connect succeeded Oct 15 11:16:42 mga264 watchquagga[9945]: bgpd state -> up : connect succeeded Oct 15 11:16:42 mga264 watchquagga[9945]: ripngd state -> up : connect succeeded Oct 15 11:16:42 mga264 watchquagga[9945]: ospfd state -> up : connect succeeded # netstat -pant | grep :26 tcp 0 0 127.0.0.1:2601 0.0.0.0:* LISTEN 9900/zebra tcp 0 0 127.0.0.1:2602 0.0.0.0:* LISTEN 9774/ripd tcp 0 0 127.0.0.1:2604 0.0.0.0:* LISTEN 9649/ospfd tcp 0 0 127.0.0.1:2605 0.0.0.0:* LISTEN 9525/bgpd tcp 0 0 0.0.0.0:2608 0.0.0.0:* LISTEN 87/isisd tcp 0 0 ::1:2603 :::* LISTEN 37/ripngd tcp 0 0 ::1:2606 :::* LISTEN 9712/ospf6d # telnet localhost 2601 (repeat for 2602,2604,2605,2608) ..etc # telnet ::1 2603 (repeat for 2606) ..etc
Whiteboard: MGA2TOO has_procedure mga3-64-ok => MGA2TOO has_procedure mga2-64-ok mga3-64-ok
Testing complete mga3 32
Whiteboard: MGA2TOO has_procedure mga2-64-ok mga3-64-ok => MGA2TOO has_procedure mga2-64-ok mga3-32-ok mga3-64-ok
Testing complete mga2 32
Whiteboard: MGA2TOO has_procedure mga2-64-ok mga3-32-ok mga3-64-ok => MGA2TOO has_procedure mga2-32-ok mga2-64-ok mga3-32-ok mga3-64-ok
Validating. Advisory uploaded. Could sysadmin please push from 2&3 core/updates_testing to updates Thanks!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed: http://advisories.mageia.org/MGASA-2013-0310.html
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED