UBUNTU-CVE-2017-3224

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2017-3224
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-3224.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-3224
Upstream
  • CVE-2017-3224
Published
2018-07-24T15:29:00Z
Modified
2025-10-24T04:46:06Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H CVSS Calculator
  • Ubuntu - low
Summary
[none]
Details

Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).

References

Affected packages

Ubuntu:Pro:16.04:LTS / quagga

Package

Name
quagga
Purl
pkg:deb/ubuntu/quagga@0.99.24.1-2ubuntu1.4+esm1?arch=source&distro=esm-infra/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.99.24.1-2
0.99.24.1-2ubuntu1
0.99.24.1-2ubuntu1.1
0.99.24.1-2ubuntu1.2
0.99.24.1-2ubuntu1.3
0.99.24.1-2ubuntu1.4
0.99.24.1-2ubuntu1.4+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.99.24.1-2ubuntu1.4+esm1",
            "binary_name": "quagga"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-3224.json"

Ubuntu:Pro:18.04:LTS / quagga

Package

Name
quagga
Purl
pkg:deb/ubuntu/quagga@1.2.4-1ubuntu0.1~esm2?arch=source&distro=esm-infra/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.1-3
1.1.1-3ubuntu1
1.2.2-1
1.2.2-1ubuntu1
1.2.4-1
1.2.4-1ubuntu0.1~esm1
1.2.4-1ubuntu0.1~esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-bgpd"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-core"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-isisd"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-ospf6d"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-ospfd"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-pimd"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-ripd"
        },
        {
            "binary_version": "1.2.4-1ubuntu0.1~esm2",
            "binary_name": "quagga-ripngd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-3224.json"

Ubuntu:20.04:LTS / quagga

Package

Name
quagga
Purl
pkg:deb/ubuntu/quagga@1.2.4-4ubuntu0.5?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.2.4-4build1
1.2.4-4ubuntu0.1
1.2.4-4ubuntu0.4
1.2.4-4ubuntu0.5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-bgpd"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-core"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-isisd"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-ospf6d"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-ospfd"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-pimd"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-ripd"
        },
        {
            "binary_version": "1.2.4-4ubuntu0.5",
            "binary_name": "quagga-ripngd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-3224.json"