CVE-2006-2223
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 11.28% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- quagga/quagga
- Source
- cve@mitre.org
References
- ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
- http://bugzilla.quagga.net/show_bug.cgi?id=261
- http://secunia.com/advisories/19910Patch, Vendor Advisory
- http://secunia.com/advisories/20137Vendor Advisory
- http://secunia.com/advisories/20138Vendor Advisory
- http://secunia.com/advisories/20221Vendor Advisory
- http://secunia.com/advisories/20420Vendor Advisory
- http://secunia.com/advisories/20421Vendor Advisory
- http://secunia.com/advisories/20782Vendor Advisory
- http://secunia.com/advisories/21159Vendor Advisory
- http://securitytracker.com/id?1016204
- http://www.debian.org/security/2006/dsa-1059
- http://www.gentoo.org/security/en/glsa/glsa-200605-15.xml
- http://www.novell.com/linux/security/advisories/2006_17_sr.html
- http://www.osvdb.org/25224
- http://www.redhat.com/support/errata/RHSA-2006-0525.html
- http://www.redhat.com/support/errata/RHSA-2006-0533.html
- http://www.securityfocus.com/archive/1/432822/100/0/threaded
- http://www.securityfocus.com/archive/1/432823/100/0/threaded
- http://www.securityfocus.com/bid/17808Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26243
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9985
- https://usn.ubuntu.com/284-1/
- ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
- http://bugzilla.quagga.net/show_bug.cgi?id=261
- http://secunia.com/advisories/19910Patch, Vendor Advisory
- http://secunia.com/advisories/20137Vendor Advisory
- http://secunia.com/advisories/20138Vendor Advisory
- http://secunia.com/advisories/20221Vendor Advisory
- http://secunia.com/advisories/20420Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.