From owner-freebsd-ports-bugs@FreeBSD.ORG Thu Nov 13 11:00:12 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7647A1065686; Thu, 13 Nov 2008 11:00:12 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 54AEC8FC19; Thu, 13 Nov 2008 11:00:12 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id mADB0Bve023343; Thu, 13 Nov 2008 11:00:11 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id mADB0BZV023342; Thu, 13 Nov 2008 11:00:11 GMT (envelope-from gnats) Resent-Date: Thu, 13 Nov 2008 11:00:11 GMT Resent-Message-Id: <200811131100.mADB0BZV023342@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Cc: kuriyama@FreeBSD.org, security@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6B1941065677 for ; Thu, 13 Nov 2008 10:59:11 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 220968FC0A for ; Thu, 13 Nov 2008 10:59:11 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from void.codelabs.ru (void.codelabs.ru [144.206.177.25]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1L0Zuo-000OhE-43 for FreeBSD-gnats-submit@freebsd.org; Thu, 13 Nov 2008 13:59:10 +0300 Message-Id: <20081113105909.ED4181AF419@void.codelabs.ru> Date: Thu, 13 Nov 2008 13:59:09 +0300 (MSK) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 X-GNATS-Notify: kuriyama@FreeBSD.org, security@freebsd.org Cc: Subject: ports/128837: [vuxml] net-mgmt/net-snmp and net-mgmt/net-snmp53: CVE-2008-4309 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Nov 2008 11:00:12 -0000 >Number: 128837 >Category: ports >Synopsis: [vuxml] net-mgmt/net-snmp and net-mgmt/net-snmp53: CVE-2008-4309 >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Nov 13 11:00:11 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 7.1-PRERELEASE i386 >Organization: Code Labs >Environment: System: FreeBSD 7.1-PRERELEASE i386 >Description: Denial of Service for the certain versions of agents from net-snmp packages. Citing by http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309: ----- Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats. ----- >How-To-Repeat: Look at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4309 and references therein. >Fix: The following VuXML entry for this issue should be evaluated and added: --- vuln.xml begins here --- net-snmp -- Denial of Service for SNMP agent via crafted GETBULK request net-snmp 5.4.2.1 net-snmp53 5.3.2.3

Wes Hardaker reports through sourceforge.net forum:

SECURITY ISSUE: A bug in the getbulk handling code could let anyone with even minimal access crash the agent. If you have open access to your snmp agents (bad bad bad; stop doing that!) or if you don't trust everyone that does have access to your agents you should updated immediately to prevent potential denial of service attacks.

Description at cve.mitre.org additionally clarifies:

Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.

 CVE-2008-4309 http://sourceforge.net/forum/forum.php?forum_id=882903 http://www.openwall.com/lists/oss-security/2008/10/31/1 http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272 2008-10-31 --- vuln.xml ends here --- Additionally, it will be very interesting if net-mgmt/net-snmp4 is vulnerable. I assume that 5.x was grown from the UCD's implementation, so it can share the common code. Currently I have no time to look at this, but if I'll do it, will report as the followup. >Release-Note: >Audit-Trail: >Unformatted: