Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Quagga update to 1.2.3 fyi

    pfSense Packages
    4
    5
    343
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • mudmanc4
      mudmanc4 last edited by

      Overview

      The Quagga BGP daemon bpgd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service, information disclosure, or remote code execution.
      Description

      CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2018-5378 (Quagga-2018-0543)

      The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash.

      CWE-415: Double Free - CVE-2018-5379 (Quagga-2018-1114)

      The Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes.

      CWE-125: Out-of-bounds Read - CVE-2018-5380 (Quagga-2018-1550)

      The Quagga BGP daemon, bgpd, can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

      CWE-228: Improper Handling of Syntactically Invalid Structure - CVE-2018-5381 (Quagga-2018-1975)

      The Quagga BGP daemon, bgpd, had a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI.

      For more information, please see Quagga's version 1.2.3 release announcement.

      The CVSS score below is based on CVE-2018-5379.
      Impact

      An unauthenticated, remote attacker may be able to use crafted input to result in a crash of bgpd or even allow a remote attacker to gain control of an affected bgpd process.
      Solution

      Apply an update

      Quagga has released version 1.2.3 to address these issues. Affected users should apply an update as soon as possible.

      http://www.kb.cert.org/vuls/id/940439

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        We'll get that updated. It looks like all of those are all for BGP though, not a lot of quagga BGP users out there on pfSense since it's only supported via raw config.

        In the meantime, consider switching to FRR instead of using quagga.

        1 Reply Last reply Reply Quote 0
        • awebster
          awebster last edited by

          Just a general observation… Quagga is for all intents and purposes a dead project, and FRR started life as a fork of Quagga, so it is possible the same vulnerabilities are in FRR too, unless of course FRR devs have dealt with them in the past.

          1 Reply Last reply Reply Quote 0
          • jimp
            jimp Rebel Alliance Developer Netgate last edited by

            Or, perhaps FRR found and fixed these long ago… (Like https://vuxml.freebsd.org/freebsd/bf266183-cec7-11e7-af2d-2047478f2f70.html seems suspiciously close to one of the current Quagga issues)

            Or one of the many patches that the FRR devs couldn't get quagga to accept fixed it.

            If FRR is also vulnerable, I'm certain they'll put out and update, and we'll update that, too.

            1 Reply Last reply Reply Quote 0
            • D
              donaldsharp last edited by

              FRR found and fixed the issues last year.  After discussion with our security experts when we ran across these issues we decided to not issue a CVE

              1 Reply Last reply Reply Quote 0
              • First post
                Last post

              Products

              • Platform Overview
              • TNSR
              • pfSense
              • Appliances

              Services

              • Training
              • Professional Services

              Support

              • Subscription Plans
              • Contact Support
              • Product Lifecycle
              • Documentation

              News

              • Media Coverage
              • Press
              • Events

              Resources

              • Blog
              • FAQ
              • Find a Partner
              • Resource Library
              • Security Information

              Company

              • About Us
              • Careers
              • Partners
              • Contact Us
              • Legal
              Our Mission

              We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

              Subscribe to our Newsletter

              Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

              © 2021 Rubicon Communications, LLC | Privacy Policy