CVE-2016-4036
published 2016-04-18CVE-2016-4036: The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to…
PriorityP421medium5.5CVSS 3.0
AVLACLPRLUINSUCHINAN
EPSS
0.38%
30.5th percentile
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| quagga | quagga | >= 0 < 0.99.22.4-3ubuntu1.2 | 0.99.22.4-3ubuntu1.2 |
| quagga | quagga | >= 0 < 0.99.24.1-2ubuntu1.1 | 0.99.24.1-2ubuntu1.1 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mcf9-56wg-9grv: The quagga package before 0
ghsa_unreviewed·2022-05-14
CVE-2016-4036 [MEDIUM] GHSA-mcf9-56wg-9grv: The quagga package before 0
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.
OSV
quagga vulnerabilities
osv·2016-10-13·CVSS 5.5
CVE-2016-4049 [MEDIUM] quagga vulnerabilities
quagga vulnerabilities
It was discovered that Quagga incorrectly handled dumping data. A remote
attacker could possibly use a large BGP packet to cause Quagga to crash,
resulting in a denial of service. (CVE-2016-4049)
It was discovered that the Quagga package incorrectly set permissions on
the configuration directory. A local user could use this issue to possibly
obtain sensitive information. (CVE-2016-4036)
OSV
CVE-2016-4036: The quagga package before 0
osv·2016-04-18·CVSS 5.5
CVE-2016-4036 [MEDIUM] CVE-2016-4036: The quagga package before 0
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.
Ubuntu
Quagga vulnerabilities
vendor_ubuntu·2016-10-13·CVSS 5.5
CVE-2016-4036 [MEDIUM] Quagga vulnerabilities
Title: Quagga vulnerabilities
Summary: Several security issues were fixed in Quagga.
It was discovered that Quagga incorrectly handled dumping data. A remote
attacker could possibly use a large BGP packet to cause Quagga to crash,
resulting in a denial of service. (CVE-2016-4049)
It was discovered that the Quagga package incorrectly set permissions on
the configuration directory. A local user could use this issue to possibly
obtain sensitive information. (CVE-2016-4036)
Instructions: After a standard system update you need to restart Quagga to make all the
necessary changes.
Red Hat
quagga: Wrong permissions allowing information leak
vendor_redhat·2016-08-23·CVSS 5.5
CVE-2016-4036 [MEDIUM] CWE-732 quagga: Wrong permissions allowing information leak
quagga: Wrong permissions allowing information leak
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.
Package: quagga (Red Hat Enterprise Linux 5) - Not affected
Package: quagga (Red Hat Enterprise Linux 6) - Not affected
Package: quagga (Red Hat Enterprise Linux 7) - Not affected
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-updates/2016-04/msg00040.htmlhttp://www.debian.org/security/2016/dsa-3654http://www.securityfocus.com/bid/87324https://bugzilla.suse.com/show_bug.cgi?id=770619http://lists.opensuse.org/opensuse-updates/2016-04/msg00040.htmlhttp://www.debian.org/security/2016/dsa-3654http://www.securityfocus.com/bid/87324https://bugzilla.suse.com/show_bug.cgi?id=770619
2016-04-18
Published