[ GLSA 200808-02 ] Net-SNMP: Multiple vulnerabilities



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200808-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Net-SNMP: Multiple vulnerabilities
Date: August 06, 2008
Bugs: #222265, #225105
ID: 200808-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities in Net-SNMP allow for authentication bypass in
snmpd and execution of arbitrary code in Perl applications using
Net-SMNP.

Background
==========

Net-SNMP is a collection of tools for generating and retrieving SNMP
data. The SNMPv3 protocol uses a keyed-Hash Message Authentication Code
(HMAC) to verify data integrity and authenticity of SNMP messages.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-analyzer/net-snmp < 5.4.1.1 >= 5.4.1.1

Description
===========

Wes Hardaker reported that the SNMPv3 HMAC verification relies on the
client to specify the HMAC length (CVE-2008-0960). John Kortink
reported a buffer overflow in the Perl bindings of Net-SNMP when
processing the OCTETSTRING in an attribute value pair (AVP) received by
an SNMP agent (CVE-2008-2292).

Impact
======

An attacker could send SNMPv3 packets to an instance of snmpd providing
a valid user name and an HMAC length value of 1, and easily conduct
brute-force attacks to bypass SNMP authentication. An attacker could
further entice a user to connect to a malicious SNMP agent with an SNMP
client using the Perl bindings, possibly resulting in the execution of
arbitrary code.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Net-SNMP users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/net-snmp-5.4.1.1"

References
==========

[ 1 ] CVE-2008-0960
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0960
[ 2 ] CVE-2008-2292
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2292

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200808-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2008 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: signature.asc
Description: This is a digitally signed message part.



Relevant Pages

  • [Full-disclosure] [ GLSA 200808-02 ] Net-SNMP: Multiple vulnerabilities
    ... Title: Net-SNMP: Multiple vulnerabilities ... snmpd and execution of arbitrary code in Perl applications using ... Net-SNMP is a collection of tools for generating and retrieving SNMP ... The SNMPv3 protocol uses a keyed-Hash Message Authentication Code ...
    (Full-Disclosure)
  • Re: snmpd strangeness
    ... I'm not even sure I'm using snmpd for anything... ... what SNMP is, or why said process is running on your machine. ... yeah, you read that right, kernel panics. ... You would have to work with the Net-SNMP folks to figure out what the ...
    (freebsd-questions)
  • Re: SNMP Setup - where is snmpconf
    ... > have been following the mrtg instructions with a fair amount of success ... Typing snmpconf gives me the app's prompt ... ... Or perhaps net-snmp is not installed? ... SNMP is a protocol used for ...
    (linux.redhat.misc)
  • SNMPv3 Authentication Bypass - CVE-2008-0960
    ... I just finished testing my latest code, it's a patch for Net-SNMP 5.4.1.1 that allow you to exploit the CVE-2008-0960 for bypass the HMAC validation on SNMP v3. ...
    (Pen-Test)