oss-security - Re: CVE Request -- net-snmp (sensitive host information disclosure)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 12 Feb 2009 10:56:42 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>,
        oss-security <oss-security@...ts.openwall.com>
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- net-snmp (sensitive host information
 disclosure)


I'm confused by the upstream diff being referenced by the Red Hat bug ID.
Specifically, it looks like some sprintf's got changed, and the result is
used for logging.  Is it certain that the attacker can bypass
authorization, or is net-snmp just mis-reporting it?

I'm going with authorization bypass at the moment.

======================================================
Name: CVE-2008-6123
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6123
Reference: MLIST:[oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
Reference: URL:http://www.openwall.com/lists/oss-security/2009/02/12/2
Reference: CNFIRM:http://bugs.gentoo.org/show_bug.cgi?id=250429
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=485211
Reference: CONFIRM:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
Reference: MISC:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp
5.0.9 through 5.4.2, when using TCP wrappers for client authorization,
does not properly parse hosts.allow rules, which allows remote
attackers to bypass intended access restrictions and execute SNMP
queries, related to "source/destination IP address confusion."

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.