==========================================================================
Ubuntu Security Notice USN-3471-1
October 31, 2017

quagga vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 17.10
– Ubuntu 17.04
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Quagga.

Software Description:
– quagga: BGP/OSPF/RIP routing daemon

Details:

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE
messages. A remote attacker could possibly use this issue to cause Quagga
to crash, resulting in a denial of service. (CVE-2017-16227)

Quentin Young discovered that Quagga incorrectly handled memory in the
telnet vty CLI. An attacker able to connect to the telnet interface could
possibly use this issue to cause Quagga to consume memory, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2017-5495)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
quagga 1.1.1-3ubuntu0.1
quagga-bgpd 1.1.1-3ubuntu0.1

Ubuntu 17.04:
quagga 1.1.1-1ubuntu0.1
quagga-bgpd 1.1.1-1ubuntu0.1

Ubuntu 16.04 LTS:
quagga 0.99.24.1-2ubuntu1.3

Ubuntu 14.04 LTS:
quagga 0.99.22.4-3ubuntu1.4

After a standard system update you need to restart Quagga to make all the
necessary changes.

References:
https://www.ubuntu.com/usn/usn-3471-1
CVE-2017-16227, CVE-2017-5495

Package Information:
https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/1.1.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.3
https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.4

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAEBCgAGBQJZ+MI4AAoJEGVp2FWnRL6TbiQP/2EYmLcNMUzL0RqQc2Efsw1T
ezNUfpnsOxxGA4QURyURKZflspj5RTGybNeAcGXAelod0BXkhVGpR+QcqaIP+72N
s88oxi1fAuzkQblG3lGR9ww1+Xer9opZ/ZSAIfyPMAT/jpL6JD6N/xgOs9UhSVUI
wl525hK5f8srPNRAOnC/N0FfLDjftFRaqOPYOgYeAvD9l7NUFairCOij59zkE1VG
kKlio/WX/2FTwS/mdX6ZRaRLEdm/14X9sZbiXuJBW0WFoD3E6xuF1wkmG3k2AIHX
hQSdkZuKlaaOsWO6Is3AWVoWrUUeEFqbTppGuoAnFCA59Va3Yd0JEq2TdLbhgDT1
UHfovXRffxj4ihJheeJGUB0D60I0pWDt2Orq+dx676k5Q9YaqL/hjf8lDgxfGeKk
kjYV4AEf/5cRo/WLr+8ly5pO7Q9fXIVfLq0wk1F/IuKen/u4mlRteSbM23RaUZlM
/uj5Ooitnnzx8leaLA9KFAvxMGfmRBn6uRpC/rYYKWIaEk0sWb3EKAZl+xVo+fgB
AM/FoQMMMBkneS5DjRHZtjR43pYTicXfPHRmjcRUOHbR3leKFame7KhM5EhXHOvQ
PQ4Vqn+g0WiuMDZFEt60RD3zx59bieWXL2bEeh9+1lFHLMDVEYh55yEDeV6gcdij
7e4b0kszeE7wK12wv+Q8
=nQ47
—–END PGP SIGNATURE—–
—