Bug 11433 - quagga new security issue CVE-2013-2236
: quagga new security issue CVE-2013-2236
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 3
: i586 Linux
: Normal Severity: normal
: ---
Assigned To: QA Team
: Sec team
: http://lwn.net/Vulnerabilities/570016/
: MGA2TOO has_procedure mga2-32-ok mga2...
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2013-10-10 19:10 CEST by David Walser
Modified: 2013-10-17 22:05 CEST (History)
2 users (show)

See Also:
Source RPM: quagga-0.99.20.1-9.mga3.src.rpm
CVE:


Attachments

Description David Walser 2013-10-10 19:10:32 CEST
Gentoo has issued an advisory today (October 10):
http://www.gentoo.org/security/en/glsa/glsa-201310-08.xml

We have already fixed the 2012 CVEs, but the CVE-2013-2236 is new.

This issue is fixed upstream in quagga-0.99.22.2, but Fedora fixed it by disabling the vulnerable features (ospfapi and ospfclient), as they don't really provide any useful functionality anyway:
http://pkgs.fedoraproject.org/cgit/quagga.git/commit/?id=c17c7f3c42845c0f6d17852a827cd2d71fe74c24

I've disabled those features as well as updating to the newest version in Cauldron in quagga-0.99.22.4-1.mga4.

For Mageia 2 and Mageia 3, I have disabled ospfapi and ospfclient.

Advisory:
========================

Updated quagga packages fix security vulnerability:

Remotely exploitable buffer overflow in ospf_api.c and ospfclient.c when
processing LSA messages in quagga before 0.99.22.2 (CVE-2013-2236).

Note: We have worked around this vulnerability by disabling the ospf_api
and ospfclient features, which did not provide useful functionality.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2236
http://lists.quagga.net/pipermail/quagga-dev/2013-July/010622.html
http://www.gentoo.org/security/en/glsa/glsa-201310-08.xml
========================

Updated packages in core/updates_testing:
========================
quagga-0.99.20.1-3.2.mga2
quagga-contrib-0.99.20.1-3.2.mga2
libquagga0-0.99.20.1-3.2.mga2
libquagga-devel-0.99.20.1-3.2.mga2
quagga-0.99.20.1-9.1.mga3
quagga-contrib-0.99.20.1-9.1.mga3
libquagga0-0.99.20.1-9.1.mga3
libquagga-devel-0.99.20.1-9.1.mga3

from SRPMS:
quagga-0.99.20.1-3.2.mga2.src.rpm
quagga-0.99.20.1-9.1.mga3.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 claire robinson 2013-10-14 10:23:31 CEST
Procedure: https://bugs.mageia.org/show_bug.cgi?id=6512#c1
Comment 2 claire robinson 2013-10-15 10:09:01 CEST
Testing complete mga3 64

Quagga displays the same warnings as dropbear, has this been addressed in Cauldron?

1/1: removing quagga-0.99.20.1-9.1.mga3.x86_64
                                 ########################################################################warning: file /etc/rc.d/init.d/zebra: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/watchquagga: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/ripngd: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/ripd: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/ospfd: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/ospf6d: remove failed: No such file or directory
warning: file /etc/rc.d/init.d/bgpd: remove failed: No such file or directory
##################################


Note: these are caused by leftover SysV init scripts which are no longer required and are harmless. See bug 11458
Comment 3 claire robinson 2013-10-15 12:34:52 CEST
Testing complete mga2 64

# for name in {bgpd,isisd,ospfd,ospf6d,ripd,ripngd,zebra,watchquagga};do service $name restart; done

Restarting bgpd (via systemctl):         [  OK  ]
Restarting isisd (via systemctl):        [  OK  ]
Restarting ospfd (via systemctl):        [  OK  ]
Restarting ospf6d (via systemctl):       [  OK  ]
Restarting ripd (via systemctl):         [  OK  ]
Restarting ripngd (via systemctl):       [  OK  ]
Restarting zebra (via systemctl):        [  OK  ]
Restarting watchquagga (via systemctl):  [  OK  ]

# tail /var/log/syslog
Oct 15 11:16:42 mga264 watchquagga[9945]: watchquagga 0.99.20.1 watching [zebra bgpd ospfd ospf6d ripd ripngd], mode [monitor]
Oct 15 11:16:42 mga264 watchquagga[9937]: Starting watchquagga: [  OK  ]
Oct 15 11:16:42 mga264 watchquagga[9945]: ospf6d state -> up : connect succeeded
Oct 15 11:16:42 mga264 watchquagga[9945]: zebra state -> up : connect succeeded
Oct 15 11:16:42 mga264 watchquagga[9945]: ripd state -> up : connect succeeded
Oct 15 11:16:42 mga264 watchquagga[9945]: bgpd state -> up : connect succeeded
Oct 15 11:16:42 mga264 watchquagga[9945]: ripngd state -> up : connect succeeded
Oct 15 11:16:42 mga264 watchquagga[9945]: ospfd state -> up : connect succeeded

# netstat -pant | grep :26
tcp        0      0 127.0.0.1:2601     0.0.0.0:*     LISTEN     9900/zebra
tcp        0      0 127.0.0.1:2602     0.0.0.0:*     LISTEN     9774/ripd
tcp        0      0 127.0.0.1:2604     0.0.0.0:*     LISTEN     9649/ospfd
tcp        0      0 127.0.0.1:2605     0.0.0.0:*     LISTEN     9525/bgpd
tcp        0      0 0.0.0.0:2608       0.0.0.0:*     LISTEN     87/isisd
tcp        0      0 ::1:2603           :::*          LISTEN     37/ripngd 
tcp        0      0 ::1:2606           :::*          LISTEN     9712/ospf6d

# telnet localhost 2601 (repeat for 2602,2604,2605,2608)
..etc

# telnet ::1 2603 (repeat for 2606)
..etc
Comment 4 claire robinson 2013-10-15 12:44:52 CEST
Testing complete mga3 32
Comment 5 claire robinson 2013-10-15 12:55:57 CEST
Testing complete mga2 32
Comment 6 claire robinson 2013-10-15 13:03:47 CEST
Validating. Advisory uploaded.

Could sysadmin please push from 2&3 core/updates_testing to updates

Thanks!
Comment 7 Thomas Backlund 2013-10-17 22:05:56 CEST
Update pushed:
http://advisories.mageia.org/MGASA-2013-0310.html

Note You need to log in before you can comment on or make changes to this bug.