Description
Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | quagga | 0.99.20.1-0+squeeze1 | DSA-2459-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | quagga +2 | 0.99.15-7.el6_3.2 | RHSA-2012:1259 |
| RHEL 5 | quagga +2 | 0.98.6-7.el5_8.1 | RHSA-2012:1258 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | quagga | No fix yet | — |
Advisories 3
- RHSA-2012:1259 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1258 Red Hat Security Advisory: quagga security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2459-1 quagga - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2012:1259 vendor-advisory
- FEDORA-2012-5411 vendor-advisory
- DSA-2459 vendor-advisory
- VU#551715 third-party-advisory
- https://bugzilla.quagga.net/show_bug.cgi?id=705
- 48949 third-party-advisory
- RHSA-2012:1258 vendor-advisory
- FEDORA-2012-5436 vendor-advisory
- FEDORA-2012-5352 vendor-advisory