Description
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | quagga | 0.98.3-7.2 | DSA-1059-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | quagga +2 | 0.98.3-2.4E | RHSA-2006:0525 |
| RHEL 3 | quagga | 0.96.2-11.3E | RHSA-2006:0525 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Quagga Routing Software Suite 0.9x - RIPd RIPv1 RESPONSE Packet Route Injection EDB-27802 · remote · May 3, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2006:0525 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1059-1 quagga - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2006:017 vendor-advisory
- USN-284-1 vendor-advisory
- quagga-ripd-ripv1-response-security-bypass(26251) vdb-entry
- 20782 third-party-advisory
- oval:org.mitre.oval:def:10775 vdb-entry signature
- 20138 third-party-advisory
- 20060503 Re: Quagga RIPD unauthenticated route injection mailing-list
- 20421 third-party-advisory
- RHSA-2006:0525 vendor-advisory
- 25225 vdb-entry
- 20137 third-party-advisory
- 1016204 vdb-entry
- 19910 third-party-advisory
- 17808 vdb-entry
- RHSA-2006:0533 vendor-advisory
- GLSA-200605-15 vendor-advisory
- 21159 third-party-advisory
- 20060503 Quagga RIPD unauthenticated route injection mailing-list
- http://bugzilla.quagga.net/show_bug.cgi?id=262
- DSA-1059 vendor-advisory
- 20221 third-party-advisory
- 20420 third-party-advisory