oss-security - Re: CVE Request -- net-snmp (sensitive host information disclosure)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0902121053330.17219@faron.mitre.org>
Date: Thu, 12 Feb 2009 10:56:42 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>,
        oss-security <oss-security@...ts.openwall.com>
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- net-snmp (sensitive host information
 disclosure)


I'm confused by the upstream diff being referenced by the Red Hat bug ID.
Specifically, it looks like some sprintf's got changed, and the result is
used for logging.  Is it certain that the attacker can bypass
authorization, or is net-snmp just mis-reporting it?

I'm going with authorization bypass at the moment.

======================================================
Name: CVE-2008-6123
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6123
Reference: MLIST:[oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
Reference: URL:http://www.openwall.com/lists/oss-security/2009/02/12/2
Reference: CNFIRM:http://bugs.gentoo.org/show_bug.cgi?id=250429
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=485211
Reference: CONFIRM:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
Reference: MISC:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp
5.0.9 through 5.4.2, when using TCP wrappers for client authorization,
does not properly parse hosts.allow rules, which allows remote
attackers to bypass intended access restrictions and execute SNMP
queries, related to "source/destination IP address confusion."

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.