The solution is to upgrade to 0.99.20.1. Cauldron is also affected. Reference: http://www.kb.cert.org/vuls/id/551715
Blocks: (none) => 5046
CC: (none) => misc
Open a different bug for cauldron. And I do not plan to upgrade stable to a new version so that will be a patch.
Nicolas Vigier has submitted the upgrade for Cauldron.
CC: (none) => boklm
Blocks: 5046 => (none)
CC: (none) => fundawang
Patched package uploaded. Advisory: ======================== Updated quagga packages fix security vulnerabilities: Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header (CVE-2012-0249). Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field (CVE-2012-0250). The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability) (CVE-2012-0255). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0249 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0250 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0255 http://www.kb.cert.org/vuls/id/551715 https://bugzilla.quagga.net/show_bug.cgi?id=705 ======================== Updated packages in core/updates_testing: ======================== quagga-0.99.18-1.2.mga1 quagga-contrib-0.99.18-1.2.mga1 libquagga0-0.99.18-1.2.mga1 libquagga-devel-0.99.18-1.2.mga1 from quagga-0.99.18-1.2.mga1.src.rpm
Assignee: bugsquad => qa-bugs
Any suggested testing procedure? :-) It'll probably be a day or two before I can dig into this to create one myself, as I'm busy trying to catch up with other tests due to time spent on iso tests last week, and a weekend mostly spent on non-linux stuff.
CC: (none) => davidwhodgins
(In reply to comment #4) > Any suggested testing procedure? :-) It'll probably be a day or two before > I can dig into this to create one myself, as I'm busy trying to catch up > with other tests due to time spent on iso tests last week, and a weekend > mostly spent on non-linux stuff. Good question! :o) You might want to ask the Mageia sysadmins, I think they use this.
I've asked for help on the sysadmin and general lists. I altered the password and started the zebra service. I was able to access the service using telnet 127.0.0.1 2601, found the help command and experimented with the show command. I did find out that with it running, I couldn't access my router, with the default config. :-) I'll try to figure out how to config each service enough to start the service, and if no one volunteers to help qa test this within a reasonable period of time, go ahead and validate the update, simply if the servers will run.
The parts that actually got patched were bgpd (one small patch) and osfpd (large patch based on 11 commits). For the osfpd part, here is the bugzilla entry with some discussion of the issues and how it was tested and the fix verified and all that upstream. Maybe it'll help? https://bugzilla.quagga.net/show_bug.cgi?id=705
netstat -tapnl|grep ':26' tcp 0 0 127.0.0.1:2601 0.0.0.0:* LISTEN 12023/zebra tcp 0 0 127.0.0.1:2604 0.0.0.0:* LISTEN 14341/ospfd tcp 0 0 127.0.0.1:2605 0.0.0.0:* LISTEN 14152/bgpd I consider testing complete on i586 for the srpm quagga-0.99.18-1.2.mga1.src.rpm Just testing that the services can be run. In /etc/quagga, I created zebra.conf with a different password, and ip route 0.0.0.0/0 192.168.10.1 (the address of my router). For bgpd.conf and ospfd.conf, I just copied that sample and changed the password. For all three, I confirmed that I could telnet to the port, use the list command to see the available commands, and tried some of the show commands.
Tested OK x86_64 Set an enable password in the confs and started the services. Telnet'd to each of the services and played with the commands I found using 'list'. I don't think we will be able to test any pratical examples but we can confirm the services start, listen and appear to work ok with no regressions. Testing complete x86_64. Validating. This is an update for mga1 only. Please see comment 3 for advisory and srpm. Could sysadmin please push from core/updates_testing to core/updates Thanks!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsHardware: i586 => All
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0107
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED
CC: boklm => (none)