[Security Announce] [ MDKSA-2007:182 ] - Updated quagga packages fix vulnerability and bugs

Posted by Bob on: 09/13/2007 11:10 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:182
http://www.mandriva.com/security/
_______________________________________________________________________

Package : quagga
Date : September 13, 2007
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

The bgpd daemon in Quagga prior to 0.99.9 allowed remote BGP peers
to cause a denial of service crash via a malformed OPEN message or
COMMUNITY attribute.

Updated packages are available that bring Quagga to version 0.99.9
which provides numerous bugfixes over the previous 0.99.3 version,
and also correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4826
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
ab6e0e1d280a6945ce7a5b47d908181c corporate/4.0/i586/libquagga0-0.99.9-0.1.20060mlcs4.i586.rpm
f0744b4772d1d15dc5d02d0642e5f0da corporate/4.0/i586/libquagga0-devel-0.99.9-0.1.20060mlcs4.i586.rpm
6d5921788f7a5c169f053013fa4dd0c5 corporate/4.0/i586/quagga-0.99.9-0.1.20060mlcs4.i586.rpm
cde3640e96e96e47384181a940a9e8c1 corporate/4.0/i586/quagga-contrib-0.99.9-0.1.20060mlcs4.i586.rpm
5e64b02beff305ba5a37272e13592739 corporate/4.0/SRPMS/quagga-0.99.9-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
24474feed270055ce5e5ed096c227e50 corporate/4.0/x86_64/lib64quagga0-0.99.9-0.1.20060mlcs4.x86_64.rpm
cac13525b2e2935e314fe8a8a0dd1626 corporate/4.0/x86_64/lib64quagga0-devel-0.99.9-0.1.20060mlcs4.x86_64.rpm
dcb01be5184742e412f99f5fa601f7a7 corporate/4.0/x86_64/quagga-0.99.9-0.1.20060mlcs4.x86_64.rpm
c8978f69636129050debd2e721bba887 corporate/4.0/x86_64/quagga-contrib-0.99.9-0.1.20060mlcs4.x86_64.rpm
5e64b02beff305ba5a37272e13592739 corporate/4.0/SRPMS/quagga-0.99.9-0.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFG6WgbmqjQ0CJFipgRAoPJAJ9gZxTHQMiR/Z+WjwIErpa/JmMQRwCg4Ckf
bzjs45A3TRaGLqsKFHZ9qqQ=
=PJRI
-----END PGP SIGNATURE-----