Tuomo Untinen

**Name of the Vulnerable Software and Affected Versions** TRÅDFRI gateway (affected versions not specified) **Description** A single malformed IEEE 802.15.4 (Zigbee) frame can make the TRÅDFRI gateway unresponsive. This results in connected lighting being unable to be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The issue is caused by an unauthenticated broadcast message, affecting all vulnerable devices within radio range. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TRÅDFRI bulb (affected versions not specified) **Description** The issue arises when an attacker sends a single malformed IEEE 802.15.4 (Zigbee) frame, causing the TRÅDFRI bulb to blink. If the same frame is replayed multiple times, the bulb performs a factory reset, resulting in the loss of configuration information about the Zigbee network and current brightness level. After this attack, all lights are on with full brightness, and a user cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-850L version 1.21WW **Description** An issue was discovered where a partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption. The vulnerability is related to an incorrectly implemented authentication mechanism in the WPA algorithm of the D-Link DIR-850L firmware. Exploitation of the vulnerability may allow an attacker to bypass security restrictions by sending specially crafted packets. **Recommendations** For D-Link DIR-850L version 1.21WW, consider disabling WPA authentication temporarily until a patch is available. Restrict access to the wireless network to minimize the risk of exploitation. Avoid using unencrypted Data Frames in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.32.4 **Description** The issue allows remote attackers to cause a denial of service due to a NULL pointer dereference via an invalid IPv6 jumbogram. **Recommendations** For versions prior to 2.6.32.4, update to version 2.6.32.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga-devel versions prior to 0.99.19 Quagga-contrib versions prior to 0.99.19 Quagga-debuginfo versions prior to 0.99.19 **Description** The issue is related to multiple vulnerabilities in the Quagga package, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A heap-based buffer overflow in the `ecommunity ecom2str` function in `bgp ecommunity.c` in `bgpd` in Quagga before version 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later. For Quagga-devel versions prior to 0.99.19, update to version 0.99.19 or later. For Quagga-contrib versions prior to 0.99.19, update to version 0.99.19 or later. For Quagga-debuginfo versions prior to 0.99.19, update to version 0.99.19 or later. As a temporary workaround, consider restricting access to the `bgpd` service until a patch is available. Avoid using the `ecommunity ecom2str` function in the affected `bgp ecommunity.c` file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga versions prior to 0.99.20 **Description** The issue affects the Quagga package in various Linux operating systems, including Red Hat Enterprise Linux, CentOS, SUSE Linux Enterprise, and openSUSE. It allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message. The `ospf flood` function in `ospf flood.c` in `ospfd` is vulnerable. This can lead to disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later. For Quagga versions prior to 0.99.20, update to version 0.99.20 or later. As a temporary workaround, consider disabling the `ospf flood` function until a patch is available. Restrict access to the vulnerable `ospfd` module to minimize the risk of exploitation. Avoid using the `ospf flood` function in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga version 0.99.15 **Description** The issue allows remote attackers to cause a denial of service via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message. This is due to the `ospf6 lsa is changed` function in `ospf6 lsa.c` in the OSPFv3 implementation in `ospf6d`. The vulnerability can lead to disruption of confidentiality, integrity, and availability of protected information. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later to resolve the issue. For Quagga version 0.99.15, update to version 0.99.19 or later to resolve the issue. As a temporary workaround, consider disabling the `ospf6 lsa is changed` function until a patch is available. Restrict access to the `ospf6d` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Quagga versions prior to 0.99.19 Quagga versions 0.99.15 and earlier **Description** The issue affects the Quagga package, allowing remote attackers to cause a denial of service via a Link State Update message with an invalid IPv6 prefix length. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely. **Recommendations** For Quagga versions prior to 0.99.19, update to version 0.99.19 or later to resolve the issue. For Quagga versions 0.99.15 and earlier, update to a version later than 0.99.15 to mitigate the risk. As a temporary workaround, consider restricting access to the ospf6d implementation until a patch is available.