Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2006-2223

Published: 05/05/2006 Updated: 18/10/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Quagga

Vulnerability Summary

RIPd in Quagga 0.98 and 0.99 prior to 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote malicious users to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.

Vulnerable Product Search on Vulmon Subscribe to Product

quagga quagga 0.98.5

quagga quagga 0.99.3

Vendor Advisories

Debian CVElist Bug Report Logs: SECURITY: Quagga RIPD unauthenticated route injection
Debian Bug report logs - #365940 SECURITY: Quagga RIPD unauthenticated route injection Package: quagga; Maintainer for quagga is Brett Parker <iDunno@sommitrealweirdcouk>; Source for quagga is src:quagga (PTS, buildd, popcon) Reported by: Christian Hammers <ch@debianorg> Date: Wed, 3 May 2006 20:48:31 UTC Severi ...
Ubuntu Security Notice: quagga vulnerabilities
Paul Jakma discovered that Quagga’s ripd daemon did not properly handle authentication of RIPv1 requests If the RIPv1 protocol had been disabled, or authentication for RIPv2 had been enabled, ripd still replied to RIPv1 requests, which could lead to information disclosure (CVE-2006-2223) ...
Debian Security Advisories: DSA-1059-1 quagga -- several vulnerabilities
Konstantin Gavrilenko discovered several vulnerabilities in quagga, the BGP/OSPF/RIP routing daemon The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-2223 Remote attackers may obtain sensitive information via RIPv1 REQUEST packets even if the quagga has been configured to use MD5 authenticati ...

Exploits

Exploit DB: Quagga Routing Software Suite 0.9x - RIPd RIPv1 Request Routing Table Disclosure
source: wwwsecurityfocuscom/bid/17808/info Quagga is susceptible to remote information-disclosure and route-injection vulnerabilities The application fails to properly ensure that required authentication and protocol configuration options are enforced These issues allow remote attackers to gain access to potentially sensitive network-r ...

References

CWE-20http://bugzilla.quagga.net/show_bug.cgi?id=261http://www.securityfocus.com/bid/17808http://secunia.com/advisories/19910http://secunia.com/advisories/20137http://www.debian.org/security/2006/dsa-1059http://www.gentoo.org/security/en/glsa/glsa-200605-15.xmlhttp://secunia.com/advisories/20138http://secunia.com/advisories/20221http://www.redhat.com/support/errata/RHSA-2006-0525.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0533.htmlhttp://securitytracker.com/id?1016204http://secunia.com/advisories/20420http://secunia.com/advisories/20421ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.aschttp://secunia.com/advisories/20782http://www.novell.com/linux/security/advisories/2006_17_sr.htmlhttp://secunia.com/advisories/21159http://www.osvdb.org/25224https://exchange.xforce.ibmcloud.com/vulnerabilities/26243https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9985https://usn.ubuntu.com/284-1/http://www.securityfocus.com/archive/1/432823/100/0/threadedhttp://www.securityfocus.com/archive/1/432822/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=365940https://usn.ubuntu.com/284-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/27801/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-38298CVE-2024-20356CVE-2023-21987CVE-2024-33217bypassCVE-2024-31804CVE-2024-32660unauthorizedSSRF
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook