Debian 9956 Published by

A quagga security update has been released for Debian GNU/Linux

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2497-1 Florian Weimer
June 20, 2012
- -------------------------------------------------------------------------

Package : quagga
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-1820
Debian Bug : 676510

It was discovered that Quagga, a routing daemon, contains a
vulnerability in processing the ORF capability in BGP OPEN messages.
A malformed OPEN message from a previously configured BGP peer could
cause bgpd to crash, causing a denial of service.

For the stable distribution (squeeze), this problem has been fixed in

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 0.99.21-3.

We recommend that you upgrade your quagga packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: