Skip to contentSkip to conversation

quagga: security bump to version 1.0.20160309

PATCH New Baruch Siach 2 participants 4 messages Mar 15, 2016 – Mar 16, 2016

lore
Share & tools
lore

Baruch Siach

author
#0 lore raw

PATCH 1/1 quagga: security bump to version 1.0.20160309

Fixes CVE-2016-2342 (AKA VU#270232): Quagga bgpd with BGP peers enabled for VPNv4 contains a buffer overflow vulnerability.

Remove the --enable-babeld and --enable-opaque-lsa configure options that were removed in this release.

See the release announcement at
https://lists.quagga.net/pipermail/quagga-dev/2016-March/014938.html.

Signed-off-by Baruch Siach <[email protected]>
---
 package/quagga/Config.in   | 9 ---------
 package/quagga/quagga.hash | 2 +-
 package/quagga/quagga.mk   | 4 +---
 3 files changed, 2 insertions(+), 13 deletions(-)
package/quagga/Config.in +0 -9
index 89ff6f25df16..56b8cad93c62 100644
@@ -24,11 +24,6 @@ config BR2_PACKAGE_QUAGGA_TCP_ZEBRA
 	  You'll want this enabled if zebra and the protocol daemon(s) run
 	  on different hosts.
 
-config BR2_PACKAGE_QUAGGA_BABELD
-	bool "BABEL protocol"
-	help
-	  Build babeld daemon.
-
 config BR2_PACKAGE_QUAGGA_BGPD
 	bool "BPGv4+ protocol"
 	help

@@ -48,10 +43,6 @@ config BR2_PACKAGE_QUAGGA_OSPFD
 	help
 	  Build ospfd daemon.
 
-config BR2_PACKAGE_QUAGGA_OPAQUE_LSA
-	bool "OSPF Opaque-LSA with OSPFAPI support (RFC2370)"
-	depends on BR2_PACKAGE_QUAGGA_OSPFD
-
 config BR2_PACKAGE_QUAGGA_OSPF6D
 	bool "OSPFv3 (IPv6) protocol"
 	help
package/quagga/quagga.hash +1 -1
index ba293c414d38..fdc7472d7506 100644
@@ -1,2 +1,2 @@
 # Locally calculated after checking pgp signature
-sha256	6fd6baadb136a801c29c1dd72d0fe69da9f19ae498e87bff7057778361e43b14	quagga-0.99.24.1.tar.xz
+sha256	034e21f87164f44f1c4c89d8fafed4acede298fe3fafbf9277f079544178c66b	quagga-1.0.20160309.tar.xz
package/quagga/quagga.mk +1 -3
index 4a5559401c05..93c01f9c37f4 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-QUAGGA_VERSION = 0.99.24.1
+QUAGGA_VERSION = 1.0.20160309
 QUAGGA_SOURCE = quagga-$(QUAGGA_VERSION).tar.xz
 QUAGGA_SITE = http://download.savannah.gnu.org/releases/quagga
 QUAGGA_DEPENDENCIES = host-gawk

@@ -22,7 +22,6 @@ QUAGGA_CONF_OPTS += --disable-capabilities
 endif
 
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_ZEBRA),--enable-zebra,--disable-zebra)
-QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_BABELD),--enable-babeld,--disable-babeld)
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_BGPD),--enable-bgpd,--disable-bgpd)
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_RIPD),--enable-ripd,--disable-ripd)
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_RIPNGD),--enable-ripngd,--disable-ripngd)

@@ -33,7 +32,6 @@ QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_WATCHQUAGGA),--enable-watchquagga,
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_ISISD),--enable-isisd,--disable-isisd)
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_BGP_ANNOUNCE),--enable-bgp-announce,--disable-bgp-announce)
 QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_TCP_ZERBRA),--enable-tcp-zebra,--disable-tcp-zebra)
-QUAGGA_CONF_OPTS += $(if $(BR2_PACKAGE_QUAGGA_OPAQUE_LSA),--enable-opaque-lsa,--disable-opaque-lsa)
 
 ifeq ($(BR2_PACKAGE_QUAGGA_SNMP),y)
 QUAGGA_CONF_ENV += ac_cv_path_NETSNMP_CONFIG=$(STAGING_DIR)/usr/bin/net-snmp-config
Signature · 1 line
2.7.0
#1 lore raw

PATCH 1/1 quagga: security bump to version 1.0.20160309

Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Fixes CVE-2016-2342 (AKA VU#270232): Quagga bgpd with BGP peers enabled for VPNv4 contains a buffer overflow vulnerability.

Quoted 7 lines

Remove the --enable-babeld and --enable-opaque-lsa configure options that were removed in this release.

See the release announcement at
https://lists.quagga.net/pipermail/quagga-dev/2016-March/014938.html.

Signed-off-by Baruch Siach <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH 1/1 quagga: security bump to version 1.0.20160309

In reply to Baruch Siach
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Fixes CVE-2016-2342 (AKA VU#270232): Quagga bgpd with BGP peers enabled for VPNv4 contains a buffer overflow vulnerability.

Remove the --enable-babeld and --enable-opaque-lsa configure options that were removed in this release.

See the release announcement at
https://lists.quagga.net/pipermail/quagga-dev/2016-March/014938.html.

This unfortunately causes some new build errors:

http://autobuild.buildroot.net/?reason=quagga-1.0.20160309

make[3]: *** No rule to make target ../ospfd/libospf.la', needed by libospfapiclient.la'. Stop.

Perhaps a parallel build issue? Care to take a look?

Signature · 1 line
Bye, Peter Korsgaard
author
#3 lore raw

PATCH 1/1 quagga: security bump to version 1.0.20160309

Hi Peter,

Quoted 11 lines · Peter Korsgaard
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Baruch" == Baruch Siach <[email protected]> writes:

Fixes CVE-2016-2342 (AKA VU#270232): Quagga bgpd with BGP peers enabled for VPNv4 contains a buffer overflow vulnerability.

Remove the --enable-babeld and --enable-opaque-lsa configure options that were removed in this release.

See the release announcement at
https://lists.quagga.net/pipermail/quagga-dev/2016-March/014938.html.

Quoted 7 lines

This unfortunately causes some new build errors:

http://autobuild.buildroot.net/?reason=quagga-1.0.20160309

make[3]: *** No rule to make target ../ospfd/libospf.la', needed by libospfapiclient.la'. Stop.

Perhaps a parallel build issue? Care to take a look?

I noticed that. I'll look into it later today.

baruch

Signature · 3 lines
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -