The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."

The remote NewStart CGSL host, running version MAIN 5.04, has net-snmp packages installed that are affected by multiple vulnerabilities:

  - SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before     5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1;
    (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource     Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp     (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2;
    (6) SNMP Research before 16.2; (7) multiple Cisco IOS,     CatOS, ACE, and Nexus products; (8) Ingate Firewall     3.1.0 and later and SIParator 3.1.0 and later; (9) HP     OpenView SNMP Emanate Master Agent 15.x; and possibly     other products relies on the client to specify the HMAC     length, which makes it easier for remote attackers to     bypass SNMP authentication via a length value of 1,     which only checks the first byte. (CVE-2008-0960)

  - Buffer overflow in the __snprint_value function in     snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in     SNMP.xs for Perl, allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a large OCTETSTRING in an attribute value pair     (AVP). (CVE-2008-2292)

  - Integer overflow in the netsnmp_create_subtree_cache     function in agent/snmp_agent.c in net-snmp 5.4 before     5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1     allows remote attackers to cause a denial of service     (crash) via a crafted SNMP GETBULK request, which     triggers a heap-based buffer overflow, related to the     number of responses or repeats. (CVE-2008-4309)

  - The netsnmp_udp_fmtaddr function     (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through     5.4.2.1, when using TCP wrappers for client     authorization, does not properly parse hosts.allow     rules, which allows remote attackers to bypass intended     access restrictions and execute SNMP queries, related to     source/destination IP address confusion.
    (CVE-2008-6123)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2009:0295 :

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Simple Network Management Protocol (SNMP) is a protocol used for network management.

It was discovered that the snmpd daemon did not use TCP wrappers correctly, causing network hosts access restrictions defined in '/etc/hosts.allow' and '/etc/hosts.deny' to not be honored. A remote attacker could use this flaw to bypass intended access restrictions.
(CVE-2008-6123)

This issue only affected configurations where hosts.allow and hosts.deny were used to limit access to the SNMP server. To obtain information from the server, the attacker would have to successfully authenticate, usually by providing a correct community string.

All net-snmp users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the snmpd and snmptrapd daemons will be restarted automatically.

The SNMP server did not correctly validate certain UDP clients when using TCP wrappers. Under some situations, a remote attacker could bypass access restrictions and communicate with the SNMP server, potentially leading to a loss of privacy or a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the snmpd daemon did not use TCP wrappers correctly, causing network hosts access restrictions defined in '/etc/hosts.allow' and '/etc/hosts.deny' to not be honored. A remote attacker could use this flaw to bypass intended access restrictions.
(CVE-2008-6123)

This issue only affected configurations where hosts.allow and hosts.deny were used to limit access to the SNMP server. To obtain information from the server, the attacker would have to successfully authenticate, usually by providing a correct community string.

After installing the update, the snmpd and snmptrapd daemons will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201001-05 (net-snmp: Authorization bypass)

    The netsnmp_udp_fmtaddr() function (snmplib/snmpUDPDomain.c), when     using TCP wrappers for client authorization, does not properly parse     hosts.allow rules.
  Impact :

    A remote, unauthenticated attacker could bypass the ACL filtering,     possibly resulting in the execution of arbitrary SNMP queries.
  Workaround :

    If possible, protect net-snmp with custom iptables rules:
    iptables -s [client] -d [host] -p udp --dport 161 -j ACCEPT     iptables -s 0.0.0.0/0 -d [host] -p udp --dport 161 -j DROP

This update of net-snmp fixes the following bugs :

  - truncated walk of hrSWRunPath (bnc#565586)

  - crash when 64-bit counters wrap (bnc#523553)

  - unknown host names in snmp traps (bnc#514333)

  - sensitive host information disclosure (bnc#475532,     CVE-2008-6123)

With this update of net-snmp the handling of TCP wrappers rules for client authorization was improved, prior to this update it was possible for remote attackers to bypass intended access restrictions and execute SNMP queries. (CVE-2008-6123) Additionally binding to multiple interfaces was improved.

A vulnerability has been identified and corrected in net-snmp :

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to source/destination IP address confusion.
(CVE-2008-6123)

The updated packages have been patched to prevent this.

- Mon Feb 16 2009 Jan Safranek <jsafranek at redhat.com>     5.4.2.1-3

    - fix tcp_wrappers integration (CVE-2008-6123)

    - Mon Dec 1 2008 Jan Safranek <jsafranek at redhat.com>       5.4.2.1-2

    - rebuild for fixed rpm (#473420)

    - Mon Nov 3 2008 Jan Safranek <jsafranek at redhat.com>       5.4.2.1-1

    - explicitly require the right version and release of       net-snmp and net-snmp-libs

  - update to net-snmp-5.4.2.1 to fix CVE-2008-4309

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Simple Network Management Protocol (SNMP) is a protocol used for network management.

It was discovered that the snmpd daemon did not use TCP wrappers correctly, causing network hosts access restrictions defined in '/etc/hosts.allow' and '/etc/hosts.deny' to not be honored. A remote attacker could use this flaw to bypass intended access restrictions.
(CVE-2008-6123)

This issue only affected configurations where hosts.allow and hosts.deny were used to limit access to the SNMP server. To obtain information from the server, the attacker would have to successfully authenticate, usually by providing a correct community string.

All net-snmp users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the snmpd and snmptrapd daemons will be restarted automatically.

ID	Name	Product	Family	Severity
127171	NewStart CGSL MAIN 5.04 : net-snmp Multiple Vulnerabilities (NS-SA-2019-0017)	Nessus	NewStart CGSL Local Security Checks	critical
67806	Oracle Linux 3 : net-snmp (ELSA-2009-0295)	Nessus	Oracle Linux Local Security Checks	medium
65124	Ubuntu 10.04 LTS : net-snmp vulnerability (USN-946-1)	Nessus	Ubuntu Local Security Checks	medium
60556	Scientific Linux Security Update : net-snmp on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
44894	GLSA-201001-05 : net-snmp: Authorization bypass	Nessus	Gentoo Local Security Checks	medium
44403	openSUSE Security Update : libsnmp15 (libsnmp15-1922)	Nessus	SuSE Local Security Checks	medium
41562	SuSE 10 Security Update : net-snmp (ZYPP Patch Number 6248)	Nessus	SuSE Local Security Checks	medium
41306	SuSE9 Security Update : net-snmp (YOU Patch Number 12441)	Nessus	SuSE Local Security Checks	medium
40269	openSUSE Security Update : libsnmp15 (libsnmp15-879)	Nessus	SuSE Local Security Checks	medium
40047	openSUSE Security Update : libsnmp15 (libsnmp15-879)	Nessus	SuSE Local Security Checks	medium
38950	openSUSE 10 Security Update : libsnmp15 (libsnmp15-6247)	Nessus	SuSE Local Security Checks	medium
36601	Mandriva Linux Security Advisory : net-snmp (MDVSA-2009:056)	Nessus	Mandriva Local Security Checks	medium
36301	Fedora 10 : net-snmp-5.4.2.1-3.fc10 (2009-1769)	Nessus	Fedora Local Security Checks	medium
36029	RHEL 3 : net-snmp (RHSA-2009:0295)	Nessus	Red Hat Local Security Checks	medium
36021	CentOS 3 : net-snmp (CESA-2009:0295)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-6123

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium