Description
bgpd in Quagga 0.98 and 0.99 before 20060504 allows local users to cause a denial of service (CPU consumption) via a certain sh ip bgp command entered in the telnet interface.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | quagga | 0.98.3-7.2 | DSA-1059-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | quagga +2 | 0.98.3-2.4E | RHSA-2006:0525 |
| RHEL 3 | quagga | 0.96.2-11.3E | RHSA-2006:0525 |
Advisories 2
- RHSA-2006:0525 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1059-1 quagga - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-284-1 vendor-advisory
- http://www.quagga.net/news2.php?y=2006&m=5&d=4#id1146764580
- oval:org.mitre.oval:def:10651 vdb-entry signature
- 25245 vdb-entry
- 20782 third-party-advisory
- 20138 third-party-advisory
- 20421 third-party-advisory
- RHSA-2006:0525 vendor-advisory
- 20137 third-party-advisory
- [quagga-dev] 20060329 quagga locks with command sh ip bgp community 1:* mailing-list
- 1016204 vdb-entry
- RHSA-2006:0533 vendor-advisory
- GLSA-200605-15 vendor-advisory
- DSA-1059 vendor-advisory
- 20221 third-party-advisory
- 20116 third-party-advisory
- 20420 third-party-advisory
- 17979 vdb-entry