The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.

According to its self-reported version, the version of Pulse Policy Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.

From Red Hat Security Advisory 2007:1045 :

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

Simple Network Management Protocol (SNMP) is a protocol used for network management.

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port (161 by default) could send a malicious packet causing snmpd to crash, resulting in a denial of service. (CVE-2007-5846)

All users of net-snmp are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port (161 by default) could send a malicious packet causing snmpd to crash, resulting in a denial of service. (CVE-2007-5846)

This update of net-snmp fixes the following bugs :

  - default and configurable maximum number of varbinds     returnable to a GETBULK request. (CVE-2007-5846)

  - added option to ignore accepted connections

This update of net-snmp fixes the following bugs :

  - Default and configurable maximum number of varbinds     returnable to a GETBULK request. (CVE-2007-5846)

  - Add option to ignore accepted connections.

a. Updated pcre Service Console package addresses several security issues

The pcre package contains the Perl-Compatible Regular Expression library.
pcre is used by various Service Console utilities.

Several security issues were discovered in the way PCRE handles regular expressions. If an application linked against PCRE parsed a malicious regular expression, it may have been possible to run arbitrary code as the user running the application.

VMware would like to thank Ludwig Nussel for reporting these issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2006-7228 and CVE-2007-1660 to these issues.

b. Updated net-snmp Service Console package addresses denial of service

net-snmp is an implementation of the Simple Network Management Protocol (SNMP).  SNMP is used by network management systems to monitor hosts.  By default ESX has this service enabled and its ports open on the ESX firewall.

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port could send a malicious packet causing snmpd to crash, resulting in a denial of service.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5846 to this issue.

c. Updated OpenPegasus Service Console package fixes overflow condition

OpenPegasus is a CIM (Common Information Model) and Web-Based Enterprise Management (WBEM) broker.  These protocols are used by network management systems to monitor and control hosts.  By default ESX has this service enabled and its ports open on the ESX firewall.

A flaw was discovered in the OpenPegasus CIM management server that might allow remote attackers to execute arbitrary code.  OpenPegasus when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, has a stack-based buffer overflow condition.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-0003 to this issue.

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

Simple Network Management Protocol (SNMP) is a protocol used for network management.

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port (161 by default) could send a malicious packet causing snmpd to crash, resulting in a denial of service. (CVE-2007-5846)

All users of net-snmp are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

Bill Trost discovered that snmpd did not properly limit GETBULK requests. A remote attacker could specify a large number of max-repetitions and cause a denial of service via resource exhaustion.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of net-snmp fixes the following bug :

  - default and configurable maximum number of varbinds     returnable to a GETBULK request (CVE-2007-5846)

  - crash when smux peers were configured with empty     passwords

This update of net-snmp fixes the following bugs :

  - default and configurable maximum number of varbinds     returnable to a GETBULK request (CVE-2007-5846) 

  - crash when smux peers were configured with empty     passwords 

  - the UCD-SNMP-MIB::memCached.0 SNMP object was missing 

  - the snmptrap command from the net-snmp package sends     traps per default on the wrong port.

This update of net-snmp fixes the following bug :

  - default and configurable maximum number of varbinds     returnable to a GETBULK request. (CVE-2007-5846)

  - crash when smux peers were configured with empty     passwords

The remote host is affected by the vulnerability described in GLSA-200711-31 (Net-SNMP: Denial of Service)

    The SNMP agent (snmpd) does not properly handle GETBULK requests with     an overly large 'max-repetitions' field.
  Impact :

    A remote unauthenticated attacker could send a specially crafted SNMP     request to the vulnerable application, possibly resulting in a high CPU     and memory consumption.
  Workaround :

    There is no known workaround at this time.

- Fri Oct 19 2007 Jan Safranek <jsafranek at redhat.com>     5.4-16

    - License: field fixed to 'BSD and CMU'

    - fix hrSWInst (#250237)

    - fix leak in UDP transport (#247771)

    - fix remote DoS attack (CVE-2007-5846)

    - Mon Oct 8 2007 Jan Safranek <jsafranek at redhat.com>       5.4-15

    - License: field changed to MIT

    - fix segfault on parsing smuxpeer without password       (#316621)

    - Thu Jun 28 2007 Jan Safranek <jsafranek at redhat.com>       5.4-14

    - fix snmptrapd hostname logging (#238587)

    - fix udpEndpointProcess remote IP address (#236551)

    - fix -M option of net-snmp-utils (#244784)

    - default snmptrapd.conf added (#243536)

    - fix crash when multiple exec statements have the same       name (#243536)

  - fix ugly error message when more interfaces share one IP     address (#209861)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.

Updated packages fix this issue.

CVE reports :

The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.

It is possible to disable the remote SNMP daemon by sending a GETBULK request with a large value for 'max-repetitions'.  A remote attacker may be able to leverage this issue to cause the daemon to consume excessive memory and CPU on the affected system while it tries unsuccessfully to process the request, thereby denying service to legitimate users.

ID	Name	Product	Family	Severity
109920	Pulse Policy Secure Multiple Vulnerabilities (SA43730)	Nessus	Misc.	medium
109919	Pulse Connect Secure Multiple Vulnerabilities (SA43730)	Nessus	Misc.	medium
67608	Oracle Linux 3 / 4 : net-snmp (ELSA-2007-1045)	Nessus	Oracle Linux Local Security Checks	high
60304	Scientific Linux Security Update : net-snmp on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
58226	SuSE9 Security Update : net-snmp (YOU Patch Number 11999)	Nessus	SuSE Local Security Checks	high
41178	SuSE9 Security Update : net-snmp (YOU Patch Number 12022)	Nessus	SuSE Local Security Checks	high
40377	VMSA-2008-0007 : Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus	Nessus	VMware ESX Local Security Checks	critical
36614	CentOS 3 / 4 : net-snmp (CESA-2007:1045)	Nessus	CentOS Local Security Checks	high
30223	Debian DSA-1483-1 : net-snmp - design error	Nessus	Debian Local Security Checks	high
29920	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : net-snmp vulnerability (USN-564-1)	Nessus	Ubuntu Local Security Checks	high
29883	openSUSE 10 Security Update : net-snmp (net-snmp-4759)	Nessus	SuSE Local Security Checks	high
29882	openSUSE 10 Security Update : net-snmp (net-snmp-4753)	Nessus	SuSE Local Security Checks	high
29528	SuSE 10 Security Update : net-snmp (ZYPP Patch Number 4755)	Nessus	SuSE Local Security Checks	high
28320	GLSA-200711-31 : Net-SNMP: Denial of Service	Nessus	Gentoo Local Security Checks	high
28303	Fedora 7 : net-snmp-5.4-16.fc7 (2007-3019)	Nessus	Fedora Local Security Checks	high
28275	Mandrake Linux Security Advisory : net-snmp (MDKSA-2007:225)	Nessus	Mandriva Local Security Checks	high
28248	RHEL 3 / 4 / 5 : net-snmp (RHSA-2007:1045)	Nessus	Red Hat Local Security Checks	high
28194	FreeBSD : net-snmp -- denial of service via GETBULK request (92f86b93-923f-11dc-a2bf-02e081235dab)	Nessus	FreeBSD Local Security Checks	high
27841	SNMP GETBULK Large max-repetitions Remote DoS	Nessus	SNMP	high

Detections

Analytics

CVE-2007-5846

medium

Tenable Plugins

medium

medium

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high