This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============4597828648175026665==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="Kfb5SHg3pUggDkWEDRJV1Hlwn7e8f8RPf"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Kfb5SHg3pUggDkWEDRJV1Hlwn7e8f8RPf
Content-Type: multipart/mixed;
 boundary="OjAn2SNLiQBJT0IPA0Pblxi0xxXo0nTTV";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <b5b9bd7a-8ae9-e7cf-d0dd-ab0d51b2dc81@canonical.com>
Subject: [USN-3471-1] Quagga vulnerabilities

--OjAn2SNLiQBJT0IPA0Pblxi0xxXo0nTTV
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3471-1
October 31, 2017

quagga vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Quagga.

Software Description:
- quagga: BGP/OSPF/RIP routing daemon

Details:

Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE
messages. A remote attacker could possibly use this issue to cause Quagga
to crash, resulting in a denial of service. (CVE-2017-16227)

Quentin Young discovered that Quagga incorrectly handled memory in the
telnet vty CLI. An attacker able to connect to the telnet interface could
possibly use this issue to cause Quagga to consume memory, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2017-5495)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  quagga                          1.1.1-3ubuntu0.1
  quagga-bgpd                     1.1.1-3ubuntu0.1

Ubuntu 17.04:
  quagga                          1.1.1-1ubuntu0.1
  quagga-bgpd                     1.1.1-1ubuntu0.1

Ubuntu 16.04 LTS:
  quagga                          0.99.24.1-2ubuntu1.3

Ubuntu 14.04 LTS:
  quagga                          0.99.22.4-3ubuntu1.4

After a standard system update you need to restart Quagga to make all the
necessary changes.

References:
  https://www.ubuntu.com/usn/usn-3471-1
  CVE-2017-16227, CVE-2017-5495

Package Information:
  https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.1
  https://launchpad.net/ubuntu/+source/quagga/1.1.1-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.3
  https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.4



--OjAn2SNLiQBJT0IPA0Pblxi0xxXo0nTTV--

--Kfb5SHg3pUggDkWEDRJV1Hlwn7e8f8RPf
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJZ+MI4AAoJEGVp2FWnRL6TbiQP/2EYmLcNMUzL0RqQc2Efsw1T
ezNUfpnsOxxGA4QURyURKZflspj5RTGybNeAcGXAelod0BXkhVGpR+QcqaIP+72N
s88oxi1fAuzkQblG3lGR9ww1+Xer9opZ/ZSAIfyPMAT/jpL6JD6N/xgOs9UhSVUI
wl525hK5f8srPNRAOnC/N0FfLDjftFRaqOPYOgYeAvD9l7NUFairCOij59zkE1VG
kKlio/WX/2FTwS/mdX6ZRaRLEdm/14X9sZbiXuJBW0WFoD3E6xuF1wkmG3k2AIHX
hQSdkZuKlaaOsWO6Is3AWVoWrUUeEFqbTppGuoAnFCA59Va3Yd0JEq2TdLbhgDT1
UHfovXRffxj4ihJheeJGUB0D60I0pWDt2Orq+dx676k5Q9YaqL/hjf8lDgxfGeKk
kjYV4AEf/5cRo/WLr+8ly5pO7Q9fXIVfLq0wk1F/IuKen/u4mlRteSbM23RaUZlM
/uj5Ooitnnzx8leaLA9KFAvxMGfmRBn6uRpC/rYYKWIaEk0sWb3EKAZl+xVo+fgB
AM/FoQMMMBkneS5DjRHZtjR43pYTicXfPHRmjcRUOHbR3leKFame7KhM5EhXHOvQ
PQ4Vqn+g0WiuMDZFEt60RD3zx59bieWXL2bEeh9+1lFHLMDVEYh55yEDeV6gcdij
7e4b0kszeE7wK12wv+Q8
=nQ47
-----END PGP SIGNATURE-----

--Kfb5SHg3pUggDkWEDRJV1Hlwn7e8f8RPf--


--===============4597828648175026665==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============4597828648175026665==--