An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

...

CVE-2016-4036

The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory...

PT-2016-1702

Name of the Vulnerable Software and Affected Versions quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 Description The issue concerns weak permissions for the /etc/quagga directory, allowing local users to obtain sensitive information by reading files in th...

PT-2016-7913

Name of the Vulnerable Software and Affected Versions quagga affected versions not specified Description The issue allows unprivileged users to enter the config directory /etc/quagga and read configuration files installed there. This is due to incorrect permissions set on the directory and files,...

PT-2016-7912

Name of the Vulnerable Software and Affected Versions quagga affected versions not specified Description The issue disallows unprivileged users to enter the config directory /etc/quagga and read configuration files installed there. The directory has a group of quagga and mode of 750, and the...