Note: This is an archival copy of Security Sun Alert 236141 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019153.1.
Solaris 10 Operating System
Date of Resolved Release
Security Vulnerabilities in the GNU Zebra and Quagga BGP Routing Daemon May Allow for Denial of Service
1. ImpactMultiple security vulnerabilities in the Quagga and GNU Zebra routing software shipped with Solaris 10 may allow a remote unprivileged user connecting from an untrusted remote BGP peer to cause a Denial of Service (DoS) to the BGP daemon.
These issue are described in the following documents:
CVE-2007-4826 at: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4826
CVE-2007-1995 at: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1995
2. Contributing FactorsThese issues can occur in the following releases:
In such cases, it is possible for the remote peer to send certain malformed BGP packets which will cause the BGP daemon to assert and exit, disrupting or even disabling BGP service.
To determine if the BGP protocol is enabled, use the 'pgrep bgpd' command:
$ pgrep -l bgpd
On a Solaris 10 system which has patch 126206-02 (SPARC) or 126207-02 (x86) or later applied, or on a Solaris 10 8/07 system, SMF can be queried:
$ svcs network/routing/bgp:quagga
STATE STIME FMRI
enabled Mar_18 svc:/network/routing/bgp:quagga
3. SymptomsThere are no predictable symptoms that would indicate the described issues have occurred.
4. WorkaroundTo work around the described issues until a patch can be applied, disable sessions to untrusted BGP peers. This can be done by configuring a BGP peer/neighbor as 'shutdown' in the configuration file, or via the telnet interface (if enabled):
router bgp 65512
neighbor <neighbor IP or peer-group> shutdown
Alternatively, on Solaris 10 8/07 and Solaris 10 systems with patch 126206-02 (SPARC) or 126207-02 (x86) or later applied, the BGP service can be disabled entirely via SMF:
# svcadm disable network/routing/bgp:quagga
On other Solaris 10 systems, the BGP daemon can be disabled with the following command:
5. ResolutionThese issues are addressed in the following releases:
Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment