An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Quagga | Quagga | * | 1.2.4 (including) |
Quagga | Ubuntu | bionic | * |
Quagga | Ubuntu | hirsute | * |
Quagga | Ubuntu | impish | * |
Quagga | Ubuntu | trusty | * |
Quagga | Ubuntu | xenial | * |