Bug 1637572 – CVE-2018-18066 net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1637572 - (CVE-2018-18066) CVE-2018-18066 net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service

Summary:	CVE-2018-18066 net-snmp: NULL pointer exception in snmp_oid_compare in snmpli...

Status:	NEW

Aliases:	CVE-2018-18066

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20151006,repor...
Keywords:	Security

Depends On:	1637573 1638911
Blocks:	1637575
	Show dependency tree / graph

Reported:	2018-10-09 09:57 EDT by Andrej Nemec
Modified:	2018-10-14 22:05 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	net-snmp 5.8
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2018-10-09 09:57:50 EDT

It was found that snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

References:

https://dumpco.re/blog/net-snmp-5.7.3-remote-dos

Upstream patch:

https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9bf8c457d/
https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/

Comment 1 Andrej Nemec 2018-10-09 09:59:22 EDT

Created net-snmp tracking bugs for this issue:

Affects: fedora-all [bug 1637573]

Comment 2 Scott Gayou 2018-10-11 17:17:40 EDT

Unable to reproduce on on Fedora or RHEL5/7. Going to try to build a version without our patches and see if it reproduces, then try and backtrace why or why this isn't working.

Comment 3 Scott Gayou 2018-10-12 12:50:59 EDT

Had to modify reproducer a bit to get it working. Reproduces on RHEL7 as an assert/segfault.

Comment 4 Scott Gayou 2018-10-12 13:00:46 EDT

Note that the attacker needs to know the community string to successfully trigger the fault/denial of service here. The default is "public", so I'll leave the CVSS score privileges required field as unauthenticated as I'm sure there are many cases where the default community string is not changed.

Note You need to log in before you can comment on or make changes to this bug.