星球 - USN-1027-1: Quagga vulnerabilities
作者：SecurityTeam | 來自：Ubuntu security notices | 2010/12/8 3:14:56
Ubuntu Security Notice USN-1027-1 December 07, 2010
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 10.04 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
Ubuntu 8.04 LTS:
Ubuntu 10.04 LTS:
In general, a standard system update will make all the necessary changes.
It was discovered that Quagga incorrectly handled certain Outbound Route
Filtering (ORF) records. A remote authenticated attacker could use this
flaw to cause a denial of service or potentially execute arbitrary code.
The default compiler options for Ubuntu 8.04 LTS and later should reduce
the vulnerability to a denial of service. (CVE-2010-2948)
It was discovered that Quagga incorrectly parsed certain AS paths. A remote
attacker could use this flaw to cause Quagga to crash, resulting in a
denial of service. (CVE-2010-2949)