CVE-2006-2223
NoneCVSS
—
EPSS
11.3%
Published
May 5, 2006
CISA due date
—
The record
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | quagga | 0 | 0.99.3-2 |
| Debian:3.1 | quagga | 0 | 0.98.3-7.2 |
| Red Hat:enterprise_linux:3::as | quagga | 0 | 0:0.96.2-11.3E |
| Red Hat:enterprise_linux:3::as | quagga-debuginfo | 0 | 0:0.96.2-11.3E |
| Red Hat:enterprise_linux:3::es | quagga | 0 | 0:0.96.2-11.3E |
| Red Hat:enterprise_linux:3::es | quagga-debuginfo | 0 | 0:0.96.2-11.3E |
| Red Hat:enterprise_linux:4::as | quagga | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::as | quagga-contrib | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::as | quagga-debuginfo | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::as | quagga-devel | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::desktop | quagga | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::desktop | quagga-contrib | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::desktop | quagga-debuginfo | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::desktop | quagga-devel | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::es | quagga | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::es | quagga-contrib | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::es | quagga-debuginfo | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::es | quagga-devel | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::ws | quagga | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::ws | quagga-contrib | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::ws | quagga-debuginfo | 0 | 0:0.98.3-2.4E |
| Red Hat:enterprise_linux:4::ws | quagga-devel | 0 | 0:0.98.3-2.4E |
| openSUSE:Tumbleweed | quagga | 0 | 1.2.4-2.14 |
Related vulnerabilities
- CVE-2006-2224 RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2… Also affects quagga
- CVE-2018-5380 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP… Also affects quagga
- CVE-2018-5378 The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the… Also affects quagga
- CVE-2018-5379 The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when… Also affects quagga
- CVE-2018-5381 The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of… Also affects quagga
- CVE-2017-16227 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote… Also affects quagga
- CVE-2017-5495 All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory… Also affects quagga
- CVE-2016-2342 The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in… Also affects quagga