snmpd: DoS in getbulk handling code in net-snmp

Debian Bug report logs - #504150
snmpd: DoS in getbulk handling code in net-snmp

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: snmpd: DoS in getbulk handling code in net-snmp

Date: Sat, 01 Nov 2008 17:51:04 +1100

Package: snmpd
Severity: grave
Tags: security, patch
Justification: user security hole

Hi

The following announcement has been released by net-snmp upstream:

SECURITY ISSUE: A bug in the getbulk handling code could let anyone
with even minimal access crash the agent. If you have open access 
to your snmp agents (bad bad bad; stop doing that!) or if you don't 
trust everyone that does have access to your agents you should 
updated immediately to prevent potential denial of service attacks.


You can find the upstream patch here[0], which applies fine to the sid
version.

Once we get a CVE id for this issue, I'll forward it to this bugreport.

For lenny, I guess an upload to sid with high urgency should be sufficient.
I'll email you soon about the stable situation.

Cheers
Steffen

[0]: http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-4-2-1/net-snmp/agent/snmp_agent.c?view=patch&r1=17272&r2=17271&pathrev=17272

Message #10 received at 504150@bugs.debian.org (full text, mbox, reply):

From: Jochen Friedrich <jochen@scram.de>

To: Steffen Joeris <steffen.joeris@skolelinux.de>, 504150@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: [Pkg-net-snmp-devel] Bug#504150: snmpd: DoS in getbulk handling code in net-snmp

Date: Mon, 03 Nov 2008 17:55:04 +0100

tags 504150 +pending
thanks

Hi Steffen,

> Once we get a CVE id for this issue, I'll forward it to this bugreport.

Looks like CVE-2008-4309 has been allocated for this bug.

I added the patch to SVN for the next upload.

Thanks,
Jochen

Message #15 received at 504150-close@bugs.debian.org (full text, mbox, reply):

From: Jochen Friedrich <jochen@scram.de>

To: 504150-close@bugs.debian.org

Subject: Bug#504150: fixed in net-snmp 5.4.1~dfsg-11

Date: Tue, 04 Nov 2008 14:02:05 +0000

Source: net-snmp
Source-Version: 5.4.1~dfsg-11

We believe that the bug you reported is fixed in the latest version of
net-snmp, which is due to be installed in the Debian FTP archive:

libsnmp-base_5.4.1~dfsg-11_all.deb
  to pool/main/n/net-snmp/libsnmp-base_5.4.1~dfsg-11_all.deb
libsnmp-dev_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/libsnmp-dev_5.4.1~dfsg-11_sparc.deb
libsnmp-perl_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/libsnmp-perl_5.4.1~dfsg-11_sparc.deb
libsnmp-python_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/libsnmp-python_5.4.1~dfsg-11_sparc.deb
libsnmp15_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/libsnmp15_5.4.1~dfsg-11_sparc.deb
net-snmp_5.4.1~dfsg-11.diff.gz
  to pool/main/n/net-snmp/net-snmp_5.4.1~dfsg-11.diff.gz
net-snmp_5.4.1~dfsg-11.dsc
  to pool/main/n/net-snmp/net-snmp_5.4.1~dfsg-11.dsc
snmp_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/snmp_5.4.1~dfsg-11_sparc.deb
snmpd_5.4.1~dfsg-11_sparc.deb
  to pool/main/n/net-snmp/snmpd_5.4.1~dfsg-11_sparc.deb
tkmib_5.4.1~dfsg-11_all.deb
  to pool/main/n/net-snmp/tkmib_5.4.1~dfsg-11_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 504150@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jochen Friedrich <jochen@scram.de> (supplier of updated net-snmp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 03 Nov 2008 17:58:35 +0100
Source: net-snmp
Binary: snmpd snmp libsnmp-base libsnmp15 libsnmp-dev libsnmp-perl libsnmp-python tkmib
Architecture: source all sparc
Version: 5.4.1~dfsg-11
Distribution: unstable
Urgency: high
Maintainer: Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>
Changed-By: Jochen Friedrich <jochen@scram.de>
Description: 
 libsnmp-base - SNMP (Simple Network Management Protocol) MIBs and documentation
 libsnmp-dev - SNMP (Simple Network Management Protocol) development files
 libsnmp-perl - SNMP (Simple Network Management Protocol) Perl5 support
 libsnmp-python - SNMP (Simple Network Management Protocol) Python support
 libsnmp15  - SNMP (Simple Network Management Protocol) library
 snmp       - SNMP (Simple Network Management Protocol) applications
 snmpd      - SNMP (Simple Network Management Protocol) agents
 tkmib      - SNMP (Simple Network Management Protocol) MIB browser
Closes: 504150
Changes: 
 net-snmp (5.4.1~dfsg-11) unstable; urgency=high
 .
   * This update fixes the following security issue:
     - CVE-2008-4309: A bug in the getbulk handling code could let anyone
       with even minimal access crash the agent. (Closes: #504150)
Checksums-Sha1: 
 387cce37a2a7a4bedcecec44c671b2ab47bf000f 1783 net-snmp_5.4.1~dfsg-11.dsc
 d6731c778fc5d3f096c330840683b30f81b43a21 82263 net-snmp_5.4.1~dfsg-11.diff.gz
 37b33a3a2922489b9961aa2a94a5589e9552c08e 1369164 libsnmp-base_5.4.1~dfsg-11_all.deb
 85f5a4bae9673d2fe93c6db43fc77f3d5e2b45f2 943614 tkmib_5.4.1~dfsg-11_all.deb
 3ea0d71993e6ecc7868ae691d3b20a67ba334d0d 957494 snmpd_5.4.1~dfsg-11_sparc.deb
 0d6353f710003d8e0983ee7246ace06dfb95f16b 1041018 snmp_5.4.1~dfsg-11_sparc.deb
 6f8721e8b08da65f9d8121865e66bbc30b948ebf 2012386 libsnmp15_5.4.1~dfsg-11_sparc.deb
 6682277e72c6e730c8bca3724e05a1d7ac37ba7f 2622856 libsnmp-dev_5.4.1~dfsg-11_sparc.deb
 61f431ef2e973011b81ee3a55b6029223e29a3b7 1025730 libsnmp-perl_5.4.1~dfsg-11_sparc.deb
 9a00d74c7bd37dded497226fe9e5e8bacfbf30ec 917606 libsnmp-python_5.4.1~dfsg-11_sparc.deb
Checksums-Sha256: 
 328d84a1aa04e14e5bd82c6a6a5fe4aa7a2770d1c25a0e5a36e853a6afe1faef 1783 net-snmp_5.4.1~dfsg-11.dsc
 218a4d9f5baa02d1437d09f498e13a9b99bb755429bec6086b9ae0635729c3c1 82263 net-snmp_5.4.1~dfsg-11.diff.gz
 c1826b1a7cd48c986b75b65bc4f337d0f43bd167ab8d440e50c5d7fb930261c4 1369164 libsnmp-base_5.4.1~dfsg-11_all.deb
 f2c3ceedb0a6bb3ade706479cc426a6179bf877851c724125e19d6f9f4242002 943614 tkmib_5.4.1~dfsg-11_all.deb
 f5df3b4f1e3d8d3d927472dd83059fe90fd2a2dd646037be19aaabdbf6f374f3 957494 snmpd_5.4.1~dfsg-11_sparc.deb
 452b17cbbc58536c7aa9cbbc2cfa3a31c75b2e56ad786db71ab91f47027037d1 1041018 snmp_5.4.1~dfsg-11_sparc.deb
 111bc564d4d6b39c500569d1cabb1e8ff3fd1b342970154a86eda46cd9093062 2012386 libsnmp15_5.4.1~dfsg-11_sparc.deb
 3392a72b2aeb04ba7b4325976064dbec47810407c167a3b95a878186b5406c86 2622856 libsnmp-dev_5.4.1~dfsg-11_sparc.deb
 98bc9d6aaaddf9451ff8edaa59ffd6083f8e91fcd438462fea700f4663c28657 1025730 libsnmp-perl_5.4.1~dfsg-11_sparc.deb
 e59c101f96ffa515fa95c72cdea6276a179fe28262496a1d984aaedadda65a5b 917606 libsnmp-python_5.4.1~dfsg-11_sparc.deb
Files: 
 21eb5b9fd20f3146391e3375dbd707aa 1783 net optional net-snmp_5.4.1~dfsg-11.dsc
 8c5a023ba848cde02be7faac8dc02d66 82263 net optional net-snmp_5.4.1~dfsg-11.diff.gz
 d72333c530db2856af65aa65f7b25825 1369164 libs optional libsnmp-base_5.4.1~dfsg-11_all.deb
 bf73604cf8eb135f0128223a608e791b 943614 net optional tkmib_5.4.1~dfsg-11_all.deb
 fafdf13b3c95408e7189ef68b272dc5f 957494 net optional snmpd_5.4.1~dfsg-11_sparc.deb
 aae008e9cfa0ca9a8c6bba2b23b74a9a 1041018 net optional snmp_5.4.1~dfsg-11_sparc.deb
 98802151ad2e4de536088604630ef123 2012386 libs optional libsnmp15_5.4.1~dfsg-11_sparc.deb
 aafad8cb36e9feb000eec6cd99786430 2622856 libdevel optional libsnmp-dev_5.4.1~dfsg-11_sparc.deb
 389ce26ecd5275a93174578daba80cdb 1025730 perl optional libsnmp-perl_5.4.1~dfsg-11_sparc.deb
 16b4ca0719efe558f38208d7c76c696c 917606 python optional libsnmp-python_5.4.1~dfsg-11_sparc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJEFLb0fhX0Y/ocz0RAgLJAJ45yTcs2vlH0IEo0MxtzTOdiz/aCwCgrbAC
w0a8tZCe5ePRwpUTP/6m3hU=
=cPa+
-----END PGP SIGNATURE-----

Message #20 received at 504150-close@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <white@debian.org>

To: 504150-close@bugs.debian.org

Subject: Bug#504150: fixed in net-snmp 5.2.3-7etch4

Date: Fri, 05 Dec 2008 19:52:36 +0000

Source: net-snmp
Source-Version: 5.2.3-7etch4

We believe that the bug you reported is fixed in the latest version of
net-snmp, which is due to be installed in the Debian FTP archive:

libsnmp-base_5.2.3-7etch4_all.deb
  to pool/main/n/net-snmp/libsnmp-base_5.2.3-7etch4_all.deb
libsnmp-perl_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp-perl_5.2.3-7etch4_i386.deb
libsnmp9-dev_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch4_i386.deb
libsnmp9_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp9_5.2.3-7etch4_i386.deb
net-snmp_5.2.3-7etch4.diff.gz
  to pool/main/n/net-snmp/net-snmp_5.2.3-7etch4.diff.gz
net-snmp_5.2.3-7etch4.dsc
  to pool/main/n/net-snmp/net-snmp_5.2.3-7etch4.dsc
snmp_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/snmp_5.2.3-7etch4_i386.deb
snmpd_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/snmpd_5.2.3-7etch4_i386.deb
tkmib_5.2.3-7etch4_all.deb
  to pool/main/n/net-snmp/tkmib_5.2.3-7etch4_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 504150@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steffen Joeris <white@debian.org> (supplier of updated net-snmp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 04 Nov 2008 14:11:29 +0100
Source: net-snmp
Binary: libsnmp9 tkmib snmp libsnmp-perl libsnmp-base libsnmp9-dev snmpd
Architecture: source all i386
Version: 5.2.3-7etch4
Distribution: stable-security
Urgency: high
Maintainer: Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>
Changed-By: Steffen Joeris <white@debian.org>
Description: 
 libsnmp-base - NET SNMP (Simple Network Management Protocol) MIBs and Docs
 libsnmp-perl - NET SNMP (Simple Network Management Protocol) Perl5 Support
 libsnmp9   - NET SNMP (Simple Network Management Protocol) Library
 libsnmp9-dev - NET SNMP (Simple Network Management Protocol) Development Files
 snmp       - NET SNMP (Simple Network Management Protocol) Apps
 snmpd      - NET SNMP (Simple Network Management Protocol) Agents
 tkmib      - NET SNMP (Simple Network Management Protocol) MIB Browser
Closes: 504150
Changes: 
 net-snmp (5.2.3-7etch4) stable-security; urgency=high
 .
   * Non-maintainer upload by the security team
   * Fix DoS in getbulk code via vectors related to the number of
     responses or repeats (Closes: #504150)
     Fixes: CVE-2008-4309
Files: 
 8018cc23033178515298d5583a74f9ff 1046 net optional net-snmp_5.2.3-7etch4.dsc
 2ccd6191c3212980956c30de392825ec 94030 net optional net-snmp_5.2.3-7etch4.diff.gz
 d579d8f28f3d704b6c09b2b480425086 1214368 libs optional libsnmp-base_5.2.3-7etch4_all.deb
 b5ccd827adbcefcca3557fa9ae28cc08 855594 net optional tkmib_5.2.3-7etch4_all.deb
 cb705c9fe9418cc9348ac935ea7b0ba2 833970 net optional snmpd_5.2.3-7etch4_i386.deb
 159b4244ef701edbe0fb8c9685b5b477 925914 net optional snmp_5.2.3-7etch4_i386.deb
 3b7ac7b8fe0da1a3909ee56aba46d464 1838900 libs optional libsnmp9_5.2.3-7etch4_i386.deb
 f05c7491a8100684c5085588738f05b5 1423294 libdevel optional libsnmp9-dev_5.2.3-7etch4_i386.deb
 3df41a0c99c41d1bccf6801011cf8ed5 920070 perl optional libsnmp-perl_5.2.3-7etch4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkQUbwACgkQ62zWxYk/rQe+fwCeOkxbnuTwgzlBwnUwuGHs11D4
xQQAn2w5lNCj2Pf2MZpCnnYVYcNl0D+v
=FRZG
-----END PGP SIGNATURE-----

Message #25 received at 504150-close@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <white@debian.org>

To: 504150-close@bugs.debian.org

Subject: Bug#504150: fixed in net-snmp 5.2.3-7etch4

Date: Wed, 17 Dec 2008 21:03:10 +0000

Source: net-snmp
Source-Version: 5.2.3-7etch4

We believe that the bug you reported is fixed in the latest version of
net-snmp, which is due to be installed in the Debian FTP archive:

libsnmp-base_5.2.3-7etch4_all.deb
  to pool/main/n/net-snmp/libsnmp-base_5.2.3-7etch4_all.deb
libsnmp-perl_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp-perl_5.2.3-7etch4_i386.deb
libsnmp9-dev_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch4_i386.deb
libsnmp9_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/libsnmp9_5.2.3-7etch4_i386.deb
net-snmp_5.2.3-7etch4.diff.gz
  to pool/main/n/net-snmp/net-snmp_5.2.3-7etch4.diff.gz
net-snmp_5.2.3-7etch4.dsc
  to pool/main/n/net-snmp/net-snmp_5.2.3-7etch4.dsc
snmp_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/snmp_5.2.3-7etch4_i386.deb
snmpd_5.2.3-7etch4_i386.deb
  to pool/main/n/net-snmp/snmpd_5.2.3-7etch4_i386.deb
tkmib_5.2.3-7etch4_all.deb
  to pool/main/n/net-snmp/tkmib_5.2.3-7etch4_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 504150@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steffen Joeris <white@debian.org> (supplier of updated net-snmp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 04 Nov 2008 14:11:29 +0100
Source: net-snmp
Binary: libsnmp9 tkmib snmp libsnmp-perl libsnmp-base libsnmp9-dev snmpd
Architecture: source all i386
Version: 5.2.3-7etch4
Distribution: stable-security
Urgency: high
Maintainer: Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>
Changed-By: Steffen Joeris <white@debian.org>
Description: 
 libsnmp-base - NET SNMP (Simple Network Management Protocol) MIBs and Docs
 libsnmp-perl - NET SNMP (Simple Network Management Protocol) Perl5 Support
 libsnmp9   - NET SNMP (Simple Network Management Protocol) Library
 libsnmp9-dev - NET SNMP (Simple Network Management Protocol) Development Files
 snmp       - NET SNMP (Simple Network Management Protocol) Apps
 snmpd      - NET SNMP (Simple Network Management Protocol) Agents
 tkmib      - NET SNMP (Simple Network Management Protocol) MIB Browser
Closes: 504150
Changes: 
 net-snmp (5.2.3-7etch4) stable-security; urgency=high
 .
   * Non-maintainer upload by the security team
   * Fix DoS in getbulk code via vectors related to the number of
     responses or repeats (Closes: #504150)
     Fixes: CVE-2008-4309
Files: 
 8018cc23033178515298d5583a74f9ff 1046 net optional net-snmp_5.2.3-7etch4.dsc
 2ccd6191c3212980956c30de392825ec 94030 net optional net-snmp_5.2.3-7etch4.diff.gz
 d579d8f28f3d704b6c09b2b480425086 1214368 libs optional libsnmp-base_5.2.3-7etch4_all.deb
 b5ccd827adbcefcca3557fa9ae28cc08 855594 net optional tkmib_5.2.3-7etch4_all.deb
 cb705c9fe9418cc9348ac935ea7b0ba2 833970 net optional snmpd_5.2.3-7etch4_i386.deb
 159b4244ef701edbe0fb8c9685b5b477 925914 net optional snmp_5.2.3-7etch4_i386.deb
 3b7ac7b8fe0da1a3909ee56aba46d464 1838900 libs optional libsnmp9_5.2.3-7etch4_i386.deb
 f05c7491a8100684c5085588738f05b5 1423294 libdevel optional libsnmp9-dev_5.2.3-7etch4_i386.deb
 3df41a0c99c41d1bccf6801011cf8ed5 920070 perl optional libsnmp-perl_5.2.3-7etch4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkQUbwACgkQ62zWxYk/rQe+fwCeOkxbnuTwgzlBwnUwuGHs11D4
xQQAn2w5lNCj2Pf2MZpCnnYVYcNl0D+v
=FRZG
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.