Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).

The remote NewStart CGSL host, running version MAIN 5.04, has net-snmp packages installed that are affected by multiple vulnerabilities:

  - SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before     5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1;
    (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource     Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp     (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2;
    (6) SNMP Research before 16.2; (7) multiple Cisco IOS,     CatOS, ACE, and Nexus products; (8) Ingate Firewall     3.1.0 and later and SIParator 3.1.0 and later; (9) HP     OpenView SNMP Emanate Master Agent 15.x; and possibly     other products relies on the client to specify the HMAC     length, which makes it easier for remote attackers to     bypass SNMP authentication via a length value of 1,     which only checks the first byte. (CVE-2008-0960)

  - Buffer overflow in the __snprint_value function in     snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in     SNMP.xs for Perl, allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a large OCTETSTRING in an attribute value pair     (AVP). (CVE-2008-2292)

  - Integer overflow in the netsnmp_create_subtree_cache     function in agent/snmp_agent.c in net-snmp 5.4 before     5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1     allows remote attackers to cause a denial of service     (crash) via a crafted SNMP GETBULK request, which     triggers a heap-based buffer overflow, related to the     number of responses or repeats. (CVE-2008-4309)

  - The netsnmp_udp_fmtaddr function     (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through     5.4.2.1, when using TCP wrappers for client     authorization, does not properly parse hosts.allow     rules, which allows remote attackers to bypass intended     access restrictions and execute SNMP queries, related to     source/destination IP address confusion.
    (CVE-2008-6123)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SunOS 5.10_x86: SMA patch.
Date this patch was last updated by Sun : Jun/29/11

SunOS 5.10: SMA patch.
Date this patch was last updated by Sun : Jun/30/11

From Red Hat Security Advisory 2008:0529 :

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Simple Network Management Protocol (SNMP) is a protocol used for network management.

A flaw was found in the way Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could use this flaw to spoof an authenticated SNMPv3 packet. (CVE-2008-0960)

A buffer overflow was found in the Perl bindings for Net-SNMP. This could be exploited if an attacker could convince an application using the Net-SNMP Perl module to connect to a malicious SNMP agent.
(CVE-2008-2292)

All users of net-snmp should upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw was found in the way Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could use this flaw to spoof an authenticated SNMPv3 packet. (CVE-2008-0960)

A buffer overflow was found in the Perl bindings for Net-SNMP. This could be exploited if an attacker could convince an application using the Net-SNMP Perl module to connect to a malicious SNMP agent.
(CVE-2008-2292)

This security update of net-snmp fixes a denial of service vulnerability (CVE-2008-2292), an authentication bypass (CVE-2008-0960) and several memory leaks.

In addition net-snmp was patched to allow customization of the agent address set.

I Security Issues

  a. OpenSSL Binaries Updated

  This fix updates the third-party OpenSSL library.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-3108 and CVE-2007-5135 to the issues   addressed by this update.

II Service Console rpm updates

  a. net-snmp Security update

  This fix upgrades the service console rpm for net-snmp to version   net-snmp-5.0.9-2.30E.24.
   Note: this update is relevant for ESX 3.0.3. The initial advisory   incorrectly stated that this update was present in ESX 3.0.3   when it was released on August 8, 2008.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-2292 and CVE-2008-0960 to the issues   addressed in net-snmp-5.0.9-2.30E.24.

  b. perl Security update

  This fix upgrades the service console rpm for perl to version   perl-5.8.0-98.EL3.

  Note: this update is relevant for ESX 3.0.3. The initial advisory   incorrectly stated that this update was present in ESX 3.0.3   when it was released on August 8, 2008.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2008-1927 to the issue addressed in   perl-5.8.0-98.EL3.

This security update fixes a denial of service vulnerability and an authentication bypass (CVE-2008-2292, CVE-2008-0960).

Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. An unauthenticated remote attacker could send specially crafted SNMPv3 traffic with a valid username and gain access to the user's views without a valid authentication passphrase. (CVE-2008-0960)

John Kortink discovered that the Net-SNMP Perl module did not correctly check the size of returned values. If a user or automated system were tricked into querying a malicious SNMP server, the application using the Perl module could be made to crash, leading to a denial of service. This did not affect Ubuntu 8.10. (CVE-2008-2292)

It was discovered that the SNMP service did not correctly handle large GETBULK requests. If an unauthenticated remote attacker sent a specially crafted request, the SNMP service could be made to crash, leading to a denial of service. (CVE-2008-4309).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was found in how Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could exploit this flaw to spoof an authenticated SNMPv3 packet (CVE-2008-0960).

A buffer overflow was found in the perl bindings for Net-SNMP that could be exploited if an attacker could convince an application using the Net-SNMP perl modules to connect to a malicious SNMP agent (CVE-2008-2292).

The updated packages have been patched to prevent these issues.

Several vulnerabilities have been discovered in NET SNMP, a suite of Simple Network Management Protocol applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0960     Wes Hardaker reported that the SNMPv3 HMAC verification     relies on the client to specify the HMAC length, which     allows spoofing of authenticated SNMPv3 packets.

  - CVE-2008-2292     John Kortink reported a buffer overflow in the
    __snprint_value function in snmp_get causing a denial of     service and potentially allowing the execution of     arbitrary code via a large OCTETSTRING in an attribute     value pair (AVP).

  - CVE-2008-4309     It was reported that an integer overflow in the     netsnmp_create_subtree_cache function in     agent/snmp_agent.c allows remote attackers to cause a     denial of service attack via a crafted SNMP GETBULK     request.

The remote host is affected by the vulnerability described in GLSA-200808-02 (Net-SNMP: Multiple vulnerabilities)

    Wes Hardaker reported that the SNMPv3 HMAC verification relies on the     client to specify the HMAC length (CVE-2008-0960). John Kortink     reported a buffer overflow in the Perl bindings of Net-SNMP when     processing the OCTETSTRING in an attribute value pair (AVP) received by     an SNMP agent (CVE-2008-2292).
  Impact :

    An attacker could send SNMPv3 packets to an instance of snmpd providing     a valid user name and an HMAC length value of 1, and easily conduct     brute-force attacks to bypass SNMP authentication. An attacker could     further entice a user to connect to a malicious SNMP agent with an SNMP     client using the Perl bindings, possibly resulting in the execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

New net-snmp packages are available for Slackware 12.0, 12.1, and
-current to fix security issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0529 advisory.

  - net-snmp SNMPv3 authentication bypass (VU#877044) (CVE-2008-0960)

  - net-snmp: buffer overflow in perl module's Perl Module __snprint_value() (CVE-2008-2292)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Tue Jun 10 2008 Jan Safranek <jsafranek at redhat.com>     5.4-18

    - fix various flaws (CVE-2008-2292 CVE-2008-0960)

    - Thu Feb 14 2008 Jan Safranek <jsafranek at redhat.com>       5.4-17

    - fixing ipNetToMediaNetAddress to show IP address       (#432780)

    - Fri Oct 19 2007 Jan Safranek <jsafranek at redhat.com>       5.4-16

    - License: field fixed to 'BSD and CMU'

    - fix hrSWInst (#250237)

    - fix leak in UDP transport (#247771)

    - fix remote DoS attack (CVE-2007-5846)

    - Mon Oct 8 2007 Jan Safranek <jsafranek at redhat.com>       5.4-15

    - License: field changed to MIT

    - fix segfault on parsing smuxpeer without password       (#316621)

    - Thu Jun 28 2007 Jan Safranek <jsafranek at redhat.com>       5.4-14

    - fix snmptrapd hostname logging (#238587)

    - fix udpEndpointProcess remote IP address (#236551)

    - fix -M option of net-snmp-utils (#244784)

    - default snmptrapd.conf added (#243536)

    - fix crash when multiple exec statements have the same       name (#243536)

  - fix ugly error message when more interfaces share one IP     address (#209861)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jun 10 2008 Jan Safranek <jsafranek at redhat.com>     5.4.1-7

    - fix various flaws (CVE-2008-2292 CVE-2008-0960)

    - Thu Feb 14 2008 Jan Safranek <jsafranek at redhat.com>       5.4.1-6

    - fixing ipNetToMediaNetAddress to show IP address       (#432780)

    - Thu Nov 15 2007 Jan Safranek <jsafranek at redhat.com>       5.4.1-5

    - added procps to build dependencies (#380321)

    - fix crash on reading xen interfaces (#386611)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jun 10 2008 Jan Safranek <jsafranek at redhat.com>     5.4.1-18

    - explicitly require lm_sensor > 3 for build (#442718)

    - fix various flaws (CVE-2008-2292 CVE-2008-0960)

    - Sat May 31 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-17

    - fix sparc handling in /usr/bin/net-snmp-config

    - Thu May 29 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-16

    - fix /usr/include/net-snmp-config.h for sparc

    - Sun May 25 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-15

    - sparc multilib handling

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Simple Network Management Protocol (SNMP) is a protocol used for network management.

A flaw was found in the way Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could use this flaw to spoof an authenticated SNMPv3 packet. (CVE-2008-0960)

A buffer overflow was found in the Perl bindings for Net-SNMP. This could be exploited if an attacker could convince an application using the Net-SNMP Perl module to connect to a malicious SNMP agent.
(CVE-2008-2292)

All users of net-snmp should upgrade to these updated packages, which contain backported patches to resolve these issues.

ID	Name	Product	Family	Severity
127171	NewStart CGSL MAIN 5.04 : net-snmp Multiple Vulnerabilities (NS-SA-2019-0017)	Nessus	NewStart CGSL Local Security Checks	critical
107861	Solaris 10 (x86) : 120273-33	Nessus	Solaris Local Security Checks	critical
107359	Solaris 10 (sparc) : 120272-31	Nessus	Solaris Local Security Checks	critical
67708	Oracle Linux 3 / 4 / 5 : net-snmp (ELSA-2008-0529)	Nessus	Oracle Linux Local Security Checks	critical
60419	Scientific Linux Security Update : net-snmp on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41223	SuSE9 Security Update : net-snmp (YOU Patch Number 12204)	Nessus	SuSE Local Security Checks	critical
40381	VMSA-2008-0013 : Updated ESX packages for OpenSSL, net-snmp, perl	Nessus	VMware ESX Local Security Checks	critical
40045	openSUSE Security Update : libsnmp15 (libsnmp15-87)	Nessus	SuSE Local Security Checks	critical
38099	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : net-snmp vulnerabilities (USN-685-1)	Nessus	Ubuntu Local Security Checks	critical
37050	Mandriva Linux Security Advisory : net-snmp (MDVSA-2008:118)	Nessus	Mandriva Local Security Checks	critical
34720	Debian DSA-1663-1 : net-snmp - several vulnerabilities	Nessus	Debian Local Security Checks	critical
33832	GLSA-200808-02 : Net-SNMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
33787	SuSE 10 Security Update : net-snmp (ZYPP Patch Number 5422)	Nessus	SuSE Local Security Checks	critical
33786	openSUSE 10 Security Update : libsnmp15 (libsnmp15-5418)	Nessus	SuSE Local Security Checks	critical
33752	Slackware 12.0 / 12.1 / current : net-snmp (SSA:2008-210-07)	Nessus	Slackware Local Security Checks	critical
33157	RHEL 4 / 5 : net-snmp (RHSA-2008:0529)	Nessus	Red Hat Local Security Checks	critical
33148	Fedora 7 : net-snmp-5.4-18.fc7 (2008-5224)	Nessus	Fedora Local Security Checks	critical
33147	Fedora 8 : net-snmp-5.4.1-7.fc8 (2008-5218)	Nessus	Fedora Local Security Checks	critical
33146	Fedora 9 : net-snmp-5.4.1-18.fc9 (2008-5215)	Nessus	Fedora Local Security Checks	critical
33142	CentOS 3 / 4 / 5 : net-snmp (CESA-2008:0529)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2008-2292

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical