CVE-2016-4036

What it actually does

Incorrect directory permissions on /etc/quagga allow any local user to read configuration files containing sensitive routing and authentication data.

Why it matters to the business

Attackers already present on the system can harvest network topology and credential information, increasing the risk of lateral movement or targeted disruption of routing services.

How an attack unfolds

A local attacker lists the contents of /etc/quagga, opens readable files, and extracts passwords, BGP/OSPF keys, or interface configurations for further reconnaissance or privilege escalation.

How to fix it

Upgrade the quagga package to 0.99.23-2.6.1 or newer on openSUSE and SUSE Linux Enterprise Server, then enforce restrictive permissions (e.g., 750 or tighter) on /etc/quagga and its contents.

How to confirm the fix worked

Confirm the installed quagga package version meets or exceeds 0.99.23-2.6.1 and verify directory permissions with ls -ld /etc/quagga; ensure only intended users and groups can read files.

Typical attack path

1. Obtain a local shell on an affected host
2. List or traverse /etc/quagga
3. Read configuration and key files
4. Use harvested data for lateral movement or persistence

How to detect it

Search package management logs and file-access audit trails for unexpected reads of files inside /etc/quagga; review historical quagga package versions on systems that may still be vulnerable.

• /etc/quagga
• quagga package version < 0.99.23-2.6.1
• unexpected local reads of quagga config files

What your security team should do

• Patch quagga to the fixed version on all affected systems
• Audit and correct permissions on /etc/quagga across the environment
• Review quagga configuration files for embedded secrets and rotate them
• Add file-integrity monitoring for /etc/quagga