National Cyber Awareness System

Vulnerability Summary for CVE-2006-2223

Overview

RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 17808

Type: Patch Information; Exploit

Hyperlink:http://www.securityfocus.com/bid/17808

External Source: SECUNIA

Name: 19910

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/19910

External Source: XF

Name: quagga-ripv1-information-disclosure(26243)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26243

External Source: UBUNTU

Name: USN-284-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-284-1

External Source: BUGTRAQ

Name: 20060503 Re: Quagga RIPD unauthenticated route injection

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/432823/100/0/threaded

External Source: BUGTRAQ

Name: 20060503 Quagga RIPD unauthenticated route table broadcast

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/432822/100/0/threaded

External Source: REDHAT

Name: RHSA-2006:0533

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0533.html

External Source: REDHAT

Name: RHSA-2006:0525

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0525.html

External Source: OSVDB

Name: 25224

Hyperlink:http://www.osvdb.org/25224

External Source: SUSE

Name: SUSE-SR:2006:017

Hyperlink:http://www.novell.com/linux/security/advisories/2006_17_sr.html

External Source: GENTOO

Name: GLSA-200605-15

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200605-15.xml

External Source: DEBIAN

Name: DSA-1059

Hyperlink:http://www.debian.org/security/2006/dsa-1059

External Source: SECTRACK

Name: 1016204

Hyperlink:http://securitytracker.com/id?1016204

External Source: SECUNIA

Name: 21159

Type: Advisory

Hyperlink:http://secunia.com/advisories/21159

External Source: SECUNIA

Name: 20782

Type: Advisory

Hyperlink:http://secunia.com/advisories/20782

External Source: SECUNIA

Name: 20421

Type: Advisory

Hyperlink:http://secunia.com/advisories/20421

External Source: SECUNIA

Name: 20420

Type: Advisory

Hyperlink:http://secunia.com/advisories/20420

External Source: SECUNIA

Name: 20221

Type: Advisory

Hyperlink:http://secunia.com/advisories/20221

External Source: SECUNIA

Name: 20138

Type: Advisory

Hyperlink:http://secunia.com/advisories/20138

External Source: SECUNIA

Name: 20137

Type: Advisory

Hyperlink:http://secunia.com/advisories/20137

External Source: OVAL

Name: oval:org.mitre.oval:def:9985

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9985

External Source: CONFIRM

Name: http://bugzilla.quagga.net/show_bug.cgi?id=261

Hyperlink:http://bugzilla.quagga.net/show_bug.cgi?id=261

External Source: SGI

Name: 20060602-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc

References to Check Content

Identifier:oval:org.mitre.oval:def:9985

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9985