BID:9029

GNU Zebra / Quagga Remote Denial of Service Vulnerability

Info

GNU Zebra / Quagga Remote Denial of Service Vulnerability

Bugtraq ID:	9029
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2003-0795
Remote:	Yes
Local:	No
Published:	Nov 12 2003 12:00AM
Updated:	Jul 12 2009 12:56AM
Credit:	The disclosure of this issue has been credited to Jonny Robertson.
Vulnerable:	SGI ProPack 2.3 SGI ProPack 2.2.1 Quagga Quagga Routing Software Suite 0.96.3 Quagga Quagga Routing Software Suite 0.96.2 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 GNU Zebra 0.93 b + Conectiva Linux Enterprise Edition 1.0 + OpenPKG OpenPKG 1.3 + OpenPKG OpenPKG 1.2 + Redhat Linux 9.0 i386 GNU Zebra 0.93 a + Redhat Linux 8.0 GNU Zebra 0.92 a + Redhat Linux 7.3 GNU Zebra 0.91 a + Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Sun Linux 5.0.7

Not Vulnerable:	Quagga Quagga Routing Software Suite 0.96.4

Discussion

GNU Zebra / Quagga Remote Denial of Service Vulnerability

It has been reported that Zebra, as well as Quagga, may be vulnerable to a remote denial of service vulnerability that may allow an attacker to cause the software to crash or hang. The issue is reported to occur if an attacker attempts to connect to the Zebra telnet management port while a password is enabled. The program will crash when attempting to dereference an invalid, possibly NULL, pointer.

All versions of GNU Zebra are said to be vulnerable to this issue. All versions of Quagga prior to 0.96.4 are also vulnerable.

Exploit / POC

GNU Zebra / Quagga Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

The following proof of concept is available:
printf '\xff\xf0\xff\xf0\xff\xf0' | nc <host> <port>

Solution / Fix

GNU Zebra / Quagga Remote Denial of Service Vulnerability

Solution:
OpenPKG has released advisory (OpenPKG-SA-2003.049) to address this issue. Users are advised to apply relative patches as soon as possible. Further information, including patch information, can be found in the attached advisory. Fixes are linked below.

Red Hat has released advisory RHSA-2003:305-12 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.

Red Hat has released advisory RHSA-2003:307-01 to address this issue in their Linux Enterprise software. Users are advised to upgrade as soon as possible. Further information, including patch information, can be found in the attached advisory.

Quagga has released version 0.96.4 which addresses this issue. Users are advised to upgrade as soon as possible.

Conectiva has released an advisory that includes updates for this issue. Conectiva also released an advisory for Conectiva Linux Enterprise Edition with fixes.

SGI has released an advisory (20031101-01-U) pertaining to their ProPack Linux distribution. The advisory has been released in response to a number of RHSA advisories, and includes a patch (Patch 10032) containing updated RPM packages relating to a number of different BIDS. These RPMs address both the Zebra and Iproute packages detailed in this BID.

Patch 10032 can be obtained via the following link:
http://support.sgi.com/

For information regarding how to obtain individual RPM packages included in Patch 10032, please see the attached advisory.

Sun has released a fix for Sun Linux 5.0.7.

Debian has issued fixes for this vulnerability.

Fixes:

GNU Zebra 0.91 a