quagga: Security Advisory - CVE-2012-1820

The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier
allows remote attackers to cause a denial of service (assertion failure
and daemon exit) by leveraging a BGP peering relationship and sending a
malformed Outbound Route Filtering (ORF) capability TLV in an OPEN
message.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1820

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>

1 files changed, 42 insertions, 0 deletions

diff --git a/meta-networking/recipes-protocols/quagga/files/0001-bgpd-relax-ORF-capability-length-handling.patch b/meta-networking/recipes-protocols/quagga/files/0001-bgpd-relax-ORF-capability-length-handling.patch
new file mode 100644
index 0000000000..0ec02dc861
--- /dev/null
+++ b/meta-networking/recipes-protocols/quagga/files/0001-bgpd-relax-ORF-capability-length-handling.patch
@@ -0,0 +1,42 @@
+From 5e728e929942d39ce5a4ab3d01c33f7b688c4e3f Mon Sep 17 00:00:00 2001
+From: David Lamparter <equinox@opensourcerouting.org>
+Date: Wed, 23 Jan 2013 05:50:24 +0100
+Subject: [PATCH] bgpd: relax ORF capability length handling
+
+Upstream-Status: Backport
+
+commit fe9bb64... "bgpd: CVE-2012-1820, DoS in bgp_capability_orf()"
+made the length test in bgp_capability_orf_entry() stricter and is now
+causing us to refuse (with CEASE) ORF capabilites carrying any excess
+data.  This does not conform to the robustness principle as laid out by
+RFC1122 ("be liberal in what you accept").
+
+Even worse, RFC5291 is quite unclear on how to use the ORF capability
+with multiple AFI/SAFIs.  It can be interpreted as either "use one
+instance, stuff everything in" but also as "use multiple instances".
+So, if not for applying robustness, we end up clearing sessions from
+implementations going by the former interpretation.  (or if anyone dares
+add a byte of padding...)
+
+Cc: Denis Ovsienko <infrastation@yandex.ru>
+Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
+---
+ bgpd/bgp_open.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/bgpd/bgp_open.c b/bgpd/bgp_open.c
+index af711cc..7bf3501 100644
+--- a/bgpd/bgp_open.c
++++ b/bgpd/bgp_open.c
+@@ -230,7 +230,7 @@ bgp_capability_orf_entry (struct peer *peer, struct capability_header *hdr)
+     }
+   
+   /* validate number field */
+-  if (sizeof (struct capability_orf_entry) + (entry.num * 2) != hdr->length)
++  if (sizeof (struct capability_orf_entry) + (entry.num * 2) > hdr->length)
+     {
+       zlog_info ("%s ORF Capability entry length error,"
+                  " Cap length %u, num %u",
+-- 
+1.7.5.4
+