Bug 348731 (CVE-2007-5623)

Summary:	CVE-2007-5623 nagios-plugins check_snmp possible buffer overflow
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Mike McGrath <mmcgrath>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jose.p.oliveira.oss, kevin
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	1.4.8-9	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-09-29 04:42:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	445569
Bug Blocks:

Description Tomas Hoger 2007-10-23 13:31:45 UTC

Stack-based buffer overflow vulnerability was discovered in the way check_snmp
parses output of snmpget command.  Long reply from malicious SNMP server may
cause check_snmp to crash or possible execute code.

Problem is reported here:

https://sourceforge.net/tracker/?func=detail&atid=397597&aid=1815362&group_id=29880

SF.net contains patch proposed by reporter, but it has not yet been accepted to
upstream CVS/SVN.

Comment 1 Lubomir Kundrak 2007-11-01 16:30:32 UTC

Needs fixing also in F8 and devel.
Ping on this.

Comment 2 Fedora Update System 2007-11-01 21:14:13 UTC

nagios-plugins-1.4.8-9.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Lubomir Kundrak 2007-11-01 23:11:05 UTC

Mike: Thanks for the package.
Reopening this to track fixing in Fedora 8.

Comment 4 Fedora Update System 2007-11-06 16:13:15 UTC

nagios-plugins-1.4.8-9.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Kevin Fenzi 2007-11-12 20:44:46 UTC

Could we also get epel4/epel5 updates please? 

Let me know when you have build them and I can push to stable for them...

Comment 7 Mike McGrath 2008-09-29 04:42:52 UTC

Sorry guys, this one slipped through the cracks, its long been fixed in epel as well.