CVE-2021-44038

Name
CVE-2021-44038
Description
An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://bugzilla.suse.com/show_bug.cgi?id=1191890
MISC https://github.com/Quagga/quagga/releases

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:* quagga >= None <= 1.2.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
quagga edge-main 1.2.4-r11 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r10 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r9 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r8 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r7 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.2.4-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga edge-main 1.1.1-r0 None fixed
quagga 3.23-main 1.2.4-r11 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.23-main 1.2.4-r10 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.22-main 1.2.4-r10 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.22-main 1.1.1-r0 None fixed
quagga 3.21-main 1.2.4-r10 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.21-main 1.2.4-r9 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.21-main 1.1.1-r0 None fixed
quagga 3.20-main 1.2.4-r9 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.20-main 1.1.1-r0 None fixed
quagga 3.19-main 1.2.4-r9 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.19-main 1.1.1-r0 None fixed
quagga 3.18-main 1.2.4-r8 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.17-main 1.2.4-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
quagga 3.12-main 1.2.4-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
quagga 3.11-main 1.2.4-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable