Bug 469349 (CVE-2008-4309)
| Summary: | CVE-2008-4309 net-snmp: numresponses calculation integer overflow in snmp_agent.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bressers, jsafrane, kreilly, mjc |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-11-13 15:42:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 469369, 469370, 469371, 469373, 469374, 469406 | ||
| Bug Blocks: | |||
Upstream SVN commit: http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17272 This is going to be RHSA-2008:0971 This is public: http://sourceforge.net/forum/forum.php?forum_id=882903 net-snmp-5.4.1-8.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/net-snmp-5.4.1-8.fc8 net-snmp-5.4.1-19.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/net-snmp-5.4.1-19.fc9 net-snmp-5.4.1-8.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. net-snmp-5.4.1-19.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0971.html Fedora: https://admin.fedoraproject.org/updates/F8/FEDORA-2008-9362 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-9367 net-snmp-5.4.2.1-1.fc10 did not make it to F10 before release and will need to be submitted as an update via bodhi. net-snmp-5.4.2.1-1.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/net-snmp-5.4.2.1-1.fc10 net-snmp-5.4.2.1-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. |
Oscar Mira-Sanchez reported (via TippingPoint/ZDI) to Net-SNMP upstream an integer overflow in the numresponses calculation in snmp_agent.c. Size of memory requirement for bulkcache array is calculated based on the values form an SNMP request without properly checking for integer overflows, resulting in an insufficient memory allocation and heap-based buffer overflow. agent/snmp_agent.c: numresponses = asp->pdu->errindex * r; [ ... ] asp->bulkcache = (netsnmp_variable_list **) malloc(numresponses * sizeof(struct varbind_list *)); Issue can be triggered by an SNMP get request.