Red Hat Bugzilla – Bug 1023570
libnetsnmpagent.so crash under certain conditions - patched upstream in 2009
Last modified: 2015-07-22 03:22:15 EDT
Description of problem: Under certain circumstances libnetsnmpagent.so can fail taking down whatever is linked with it. This has been observed with Asterisk 1.8 and 11 running on CentOS 6.3 and 6.4. This appears to be identical to an issue reported and resolved in the upstream project - http://sourceforge.net/p/net-snmp/bugs/2073/ - patch visible at http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=revision&revision=17856 The current version of net-snmp in CentOS & RHEL 6.4, 5.5-44.el6_4.4, does not have this patch incorporated. Version-Release number of selected component (if applicable): 5.5-44.el6_4.4 How reproducible: Not simple Steps to Reproduce: 1. 2. 3. Actual results: Sometimes crashes can occur in whatever application uses libnetsnmpagent, in this case Asterisk's res_snmp module. Expected results: No crashes would be ideal Additional info: This has been raised on the CentOS issue tracker as http://bugs.centos.org/view.php?id=6712 Previously raised Asterisk issue for this crash: https://issues.asterisk.org/jira/browse/ASTERISK-22014
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
net-snmp-5.3 is also unpatched on el5
Created attachment 847680 [details] el5 spec diff Patch against current el5 net-snmp.spec file
Created attachment 847681 [details] Patch for net-snmp-5.3 Patch for issue on el5
I just checked net-snmp-5.5-49.el6.src.rpm in EL6.5 and the patch/fix is not present either. Will this fix be included in a net-snmp update for EL6.5 or will it be included in EL6.6?
Technically this is a DoS vulnerabilty for any application using net-snmp since I can crash random apps just by running snmpwalk a few times. Is there any news on patching this?
Please note that Bugzilla is not a support tool. I acknowledge there might be a bug in snmpd, I understand it's annoying one, however, adding new comments here won't change anything. Please create tickets at access.redhat.com to get the service you pay for.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1385.html