newsQuagga Routing Software - News: Quagga 0.99.22.3 Released

 
 
Latest News
Quagga 0.99.22.3 Released posted by equinox, Sun 04 Aug 2013 01:44:00 PM UTC - 0 replies
Quagga 0.99.22.1 Released posted by equinox, Mon 15 Apr 2013 10:46:05 AM UTC - 0 replies
Quagga 0.99.22 Released posted by equinox, Mon 11 Feb 2013 01:21:58 PM UTC - 0 replies
Quagga 0.99.21 Released posted by equinox, Tue 01 May 2012 09:11:07 PM UTC - 0 replies
Quagga 0.99.20.1 Released posted by equinox, Mon 12 Mar 2012 12:17:00 PM UTC - 0 replies
[Submit News]
[10 news in archive]

Quagga 0.99.22.3 Released

Item posted by David Lamparter <equinox> on Sun 04 Aug 2013 01:44:00 PM UTC.

Quagga 0.99.22.3 has been released, and is available in the usual place. This is a stable release, addressing a security issue in the OSPF Opaque LSA API.

Please click Read More below to read the list of changes.

This release fixes a single issue with the OSPF Opaque LSA API. When the API is both enabled during build with --enable-ospfapi (default) and enabled at runtime with -a (not default), then it is possible to perform a remote code execution exploit against ospfd. (CVE-2013-2236)

The issue is believed to have been present ever since the OSPF API was added, going back at least to 0.98.x versions.

Advised behaviour is to first check whether you are running ospfd with the -a command line switch. If this switch is not present (or ospfd is not running at all), you are not affected by this issue. If you are using the switch, first confirm whether you are actually using the OSPF API. If you do indeed need the API - this is assumed to be only a very small subset of users - you will need to install 0.99.22.3. If the switch is present through some distribution default, you can avert the issue by removing it from the configuration.

0.99.22.4 is planned to be available in a few days, containing some regression fixes. If you are not affected by the security issue, you may prefer to skip over 0.99.22.3.

0.99.22.2 was never released.

Comments:

No messages in Quagga 0.99.22.3 Released

 

Back to the top


Powered by Savane 3.1-cleanup