Ubuntu
net-snmp package

[net-snmp] remote Denial of Service vulnerability

  1. Gutsy (7.10)
  2. Bug #164007
Bug #164007 reported by disabled.user
256
Affects Status Importance Assigned to Milestone
net-snmp (Ubuntu)
Fix Released
Undecided
Stephan Rügamer
Dapper
Fix Released
Undecided
Unassigned
Edgy
Fix Released
Undecided
Unassigned
Feisty
Fix Released
Undecided
Unassigned
Gutsy
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: snmp

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846

Quoting:
"The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value."

Revision history for this message
Stephan Rügamer (sruegamer) wrote :

Working on it

Changed in net-snmp:
assignee: nobody → shermann
status: New → Confirmed
Stephan Rügamer (sruegamer)
Changed in net-snmp:
status: Confirmed → In Progress
Revision history for this message
Stephan Rügamer (sruegamer) wrote :
Revision history for this message
Stephan Rügamer (sruegamer) wrote :

Upstream is using this patch http://sourceforge.net/tracker/download.php?group_id=12694&atid=112694&file_id=228217&aid=1712988 for fixing this CVE.
I talked to Pitti about the introduction of two new configuration settings, which is done in this patch.

He agreed with me, that's the best way to go...the logic of the fix is sane and reproducable...so I think we can live with this patch....

Will work tomorrow morning on the other releases...and provide debdiffs...stay tuned :)

\sh

Revision history for this message
Stephan Rügamer (sruegamer) wrote :
Revision history for this message
Stephan Rügamer (sruegamer) wrote :
Revision history for this message
Stephan Rügamer (sruegamer) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package net-snmp - 5.3.1-6ubuntu2.1

---------------
net-snmp (5.3.1-6ubuntu2.1) gutsy-security; urgency=low

  * SECURITY UPDATE: CVE-2007-5846 (LP: #164007)
    The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to
    cause a denial of service (CPU and memory consumption) via a GETBULK request
    with a large max-repeaters value.
  * debian/patches/50_CVE-2007-5846.patch,
    debian/patches/50_CVE-2007-5846.README:
    Applied patch from upstream and explanation
    (Link: http://sourceforge.net/tracker/index.php?func=detail&aid=1712988&group_id=12694&atid=112694 )
  * References:
    CVE-2007-5846

 -- Stephan Hermann <email address hidden> Tue, 20 Nov 2007 22:06:58 +0100

Changed in net-snmp:
status: In Progress → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

http://www.ubuntu.com/usn/usn-564-1

Changed in net-snmp (Ubuntu Dapper):
status: New → Fix Released
Changed in net-snmp (Ubuntu Edgy):
status: New → Fix Released
Changed in net-snmp (Ubuntu Feisty):
status: New → Fix Released
Changed in net-snmp (Ubuntu Gutsy):
status: New → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.