Cloudanix VulnDB

CVE-2013-2236

None

CVSS

—

EPSS

2.1%

Published

Oct 24, 2013

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in older network routing software can let someone send bad information that crashes the system and interrupts network traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Denial Of Service
Component
Network Service
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack-based buffer overflow in the new_msg_lsa_change_notify function in ospf_api.c when --enable-opaque-lsa and -a are enabled, allowing remote attackers to crash the OSPFD process via an oversized LSA.

Why it matters to the business

Disrupts network routing services and can lead to outages in environments relying on Quagga for OSPF operations; low exploitation likelihood reduces urgency but still requires patching on affected systems.

How an attack unfolds

An attacker sends a specially crafted large opaque LSA to the OSPFD API listener enabled via command-line options, overflowing the stack buffer and crashing the daemon.

How to fix it

Upgrade Quagga to version 0.99.22.2 or later; for listed flashplugin-nonfree packages on Ubuntu 14.04 LTS apply the update to 11.2.202.442ubuntu0.14.04.1.

How to confirm the fix worked

Confirm Quagga version is at least 0.99.22.2 and verify that the -a option combined with opaque LSA support is disabled or no longer present in ospf_api.c.

Typical attack path

  1. Identify hosts running Quagga with opaque LSA support and API enabled
  2. Craft and transmit an oversized LSA message to the API endpoint
  3. Trigger the buffer overflow leading to denial of service

How to detect it

Review system logs for unexpected OSPFD crashes or segmentation faults around the time large LSA traffic would have been processed; check for presence of the vulnerable ospf_api.c code.

What your security team should do

  • Apply the listed fixed package versions immediately on all affected Ubuntu 14.04 systems
  • Disable the OSPFD API (-a) unless explicitly required
  • Monitor EPSS and exploit maturity indicators for any future increase in risk

The record

Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.

Affected packages

Ecosystem Package Introduced Fixed
Debian:6.0 quagga 0 0.99.20.1-0+squeeze5
Debian:7 quagga 0 0.99.22.4-1+wheezy1
Mageia:2 quagga 0 0.99.20.1-3.2.mga2
Mageia:3 quagga 0 0.99.20.1-9.1.mga3
Red Hat:enterprise_linux:6::server quagga 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::server quagga-contrib 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::server quagga-debuginfo 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::server quagga-devel 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::workstation quagga 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::workstation quagga-contrib 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::workstation quagga-debuginfo 0 0:0.99.15-14.el6
Red Hat:enterprise_linux:6::workstation quagga-devel 0 0:0.99.15-14.el6
Ubuntu:14.04:LTS quagga 0 0.99.22.4-1
Ubuntu:14.04:LTS quagga 0 0.99.22.4-3ubuntu1.1
openSUSE:Tumbleweed quagga 0 1.0.20160315-5.1

Related vulnerabilities