Description
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | quagga | 0.98.3-7.2 | DSA-1059-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | quagga +2 | 0.98.3-2.4E | RHSA-2006:0525 |
| RHEL 3 | quagga | 0.96.2-11.3E | RHSA-2006:0525 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | quagga | 1.2.4-2.14 | openSUSE-SU-2024:11290-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Quagga Routing Software Suite 0.9x - RIPd RIPv1 Request Routing Table Disclosure EDB-27801 · remote · May 3, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2006:0525 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1059-1 quagga - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11290-1 libfpm_pb0-1.2.4-2.14 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SR:2006:017 vendor-advisory
- USN-284-1 vendor-advisory
- quagga-ripv1-information-disclosure(26243) vdb-entry
- 20782 third-party-advisory
- 20138 third-party-advisory
- 20060503 Re: Quagga RIPD unauthenticated route injection mailing-list
- 20421 third-party-advisory
- 25224 vdb-entry
- RHSA-2006:0525 vendor-advisory
- 20137 third-party-advisory
- http://bugzilla.quagga.net/show_bug.cgi?id=261
- 1016204 vdb-entry
- 19910 third-party-advisory
- oval:org.mitre.oval:def:9985 vdb-entry signature
- 17808 vdb-entry
- RHSA-2006:0533 vendor-advisory
- GLSA-200605-15 vendor-advisory
- 21159 third-party-advisory
- 20060503 Quagga RIPD unauthenticated route table broadcast mailing-list
- DSA-1059 vendor-advisory
- 20221 third-party-advisory
- 20420 third-party-advisory