newsQuagga Routing Software - News: Quagga Released

Latest News
Quagga 1.0.20160315 Released posted by donaldsharp, Tue 15 Mar 2016 11:27:35 PM UTC - 0 replies
Quagga 1.0.20160309 Released posted by donaldsharp, Wed 09 Mar 2016 07:27:21 PM UTC - 0 replies
Quagga Released posted by equinox, Sat 07 Mar 2015 07:16:55 AM UTC - 0 replies
Quagga 0.99.24 Released posted by equinox, Tue 03 Mar 2015 12:13:47 AM UTC - 0 replies
Quagga Released posted by equinox, Tue 26 Aug 2014 08:08:33 PM UTC - 0 replies
[Submit News]
[16 news in archive]

Quagga Released

Item posted by David Lamparter <equinox> on Sun 04 Aug 2013 01:44:00 PM UTC.

Quagga has been released, and is available in the usual place. This is a stable release, addressing a security issue in the OSPF Opaque LSA API.

Please click Read More below to read the list of changes.

This release fixes a single issue with the OSPF Opaque LSA API. When the API is both enabled during build with --enable-ospfapi (default) and enabled at runtime with -a (not default), then it is possible to perform a remote code execution exploit against ospfd. (CVE-2013-2236)

The issue is believed to have been present ever since the OSPF API was added, going back at least to 0.98.x versions.

Advised behaviour is to first check whether you are running ospfd with the -a command line switch. If this switch is not present (or ospfd is not running at all), you are not affected by this issue. If you are using the switch, first confirm whether you are actually using the OSPF API. If you do indeed need the API - this is assumed to be only a very small subset of users - you will need to install If the switch is present through some distribution default, you can avert the issue by removing it from the configuration. is planned to be available in a few days, containing some regression fixes. If you are not affected by the security issue, you may prefer to skip over was never released.


No messages in Quagga Released


Back to the top

Powered by Savane 3.1-cleanup