newsQuagga Routing Software - News: Quagga Released

Latest News
Quagga 1.2.4 Released posted by paul, Mon 19 Feb 2018 09:49:01 PM UTC - 0 replies
Quagga 1.2.3 Release, with significant BGP security fixes posted by paul, Thu 15 Feb 2018 09:38:08 PM UTC - 0 replies
Quagga 1.2.2 release posted by balajig81, Tue 03 Oct 2017 05:00:55 PM UTC - 0 replies
Quagga 1.2.1 release posted by paul, Fri 10 Mar 2017 01:39:20 PM UTC - 0 replies
Quagga 1.2.0 has been released posted by paul, Wed 08 Feb 2017 03:40:08 PM UTC - 0 replies
[Submit News]
[25 news in archive]

Quagga Released

Item posted by David Lamparter <equinox> on Sun 04 Aug 2013 01:44:00 PM UTC.

Quagga has been released, and is available in the usual place. This is a stable release, addressing a security issue in the OSPF Opaque LSA API.

Please click Read More below to read the list of changes.

This release fixes a single issue with the OSPF Opaque LSA API.  When the API is both enabled during build with --enable-ospfapi (default) and enabled at runtime with -a (not default), then it is possible to perform a remote code execution exploit against ospfd.  (CVE-2013-2236)

The issue is believed to have been present ever since the OSPF API was added, going back at least to 0.98.x versions.

Advised behaviour is to first check whether you are running ospfd with the -a command line switch.  If this switch is not present (or ospfd is not running at all), you are not affected by this issue.  If you are using the switch, first confirm whether you are actually using the OSPF API.  If you do indeed need the API - this is assumed to be only a very small subset of users - you will need to install  If the switch is present through some distribution default, you can avert the issue by removing it from the configuration. is planned to be available in a few days, containing some regression fixes.  If you are not affected by the security issue, you may prefer to skip over was never released.

No messages in Quagga Released


Back to the top

Powered by Savane 3.5