CVE-2006-2223: Input Validation
RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2223?
CVE-2006-2223 is categorized as having a medium severity, as it allows remote attackers to access sensitive routing information.
How do I fix CVE-2006-2223?
To fix CVE-2006-2223, upgrade Quagga to version 0.98.6 or 0.99.4 or later where the vulnerability is addressed.
What versions are affected by CVE-2006-2223?
The vulnerable versions of Quagga are 0.98.5 and 0.99.3.
Can CVE-2006-2223 lead to data leakage?
Yes, CVE-2006-2223 can lead to data leakage as it allows attackers to obtain sensitive routing state information through REQUEST packets.
Is there a workaround for CVE-2006-2223?
While upgrading is the best option, a potential workaround is to disable RIPv1 and enforce authentication requirements if possible.