quagga security issue CVE-2012-1820

[Ernest Johanson]

Hello,

I'd like to know when the security issue reported in CVE-2012-1820 will be fixed in the Ubuntu quagga pacakge. I'm running Ubuntu 10.04.1 LTS with quagga 0.99.20.1-0ubuntu0.10.04.2 installed. The changelog.Debian doesn't mention CVE-2012-1820. The Debain package is currently fixed: http://www.debian.org/security/2012/dsa-2497.

Thanks,

Ernie Johanson
Network Engineer
California Institute of Technology

[Serge Hallyn (serge-hallyn)]

Thanks for reporting this bug. Indeed it looks as though it has been fixed in quantal but not lucid, and looking at the patch it looks as though it may also be vulnerable.

[Marc Deslauriers (mdeslaur)]

We have rated this as a "low" severity issue, so it will only get fixed if more important vulnerabilities are discovered in Quagga. See the security team tracker:

http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-1820.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package quagga - 0.99.20.1-0ubuntu0.12.04.3

---------------
quagga (0.99.20.1-0ubuntu0.12.04.3) precise-security; urgency=low

  * SECURITY UPDATE: denial of service via malformed ORF capability TLV
    (LP: #1018052)
    - debian/patches/CVE-2012-1820.patch: correctly follow spec in
      bgpd/bgp_open.c.
    - CVE-2012-1820
 -- Marc Deslauriers <email address hidden> Thu, 11 Oct 2012 09:57:06 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package quagga - 0.99.20.1-0ubuntu0.10.04.3

---------------
quagga (0.99.20.1-0ubuntu0.10.04.3) lucid-security; urgency=low

  * SECURITY UPDATE: denial of service via malformed ORF capability TLV
    (LP: #1018052)
    - debian/patches/CVE-2012-1820.patch: correctly follow spec in
      bgpd/bgp_open.c.
    - CVE-2012-1820
 -- Marc Deslauriers <email address hidden> Thu, 11 Oct 2012 10:02:33 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package quagga - 0.99.20.1-0ubuntu0.11.04.3

---------------
quagga (0.99.20.1-0ubuntu0.11.04.3) natty-security; urgency=low

  * SECURITY UPDATE: denial of service via malformed ORF capability TLV
    (LP: #1018052)
    - debian/patches/CVE-2012-1820.patch: correctly follow spec in
      bgpd/bgp_open.c.
    - CVE-2012-1820
 -- Marc Deslauriers <email address hidden> Thu, 11 Oct 2012 10:01:33 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package quagga - 0.99.20.1-0ubuntu0.11.10.3

---------------
quagga (0.99.20.1-0ubuntu0.11.10.3) oneiric-security; urgency=low

  * SECURITY UPDATE: denial of service via malformed ORF capability TLV
    (LP: #1018052)
    - debian/patches/CVE-2012-1820.patch: correctly follow spec in
      bgpd/bgp_open.c.
    - CVE-2012-1820
 -- Marc Deslauriers <email address hidden> Thu, 11 Oct 2012 10:00:32 -0400