SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Net-snmp Vendors:   [Multiple Authors/Vendors]
(Caldera Issues Fix) Net-snmp (formerly ucd-snmp) File Name Buffer Overflow Lets Local Users Execute Arbitrary Code
SecurityTracker Alert ID:  1002346
SecurityTracker URL:  http://securitytracker.com/id/1002346
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 8 2001
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.2.1
Description:   A vulnerability was reported in the SNMP daemon in the net-snmp distribution (formerly known as ucd-snmp). The security hole allows local users to execute arbitrary code on the host.

It is reported that when snmpd is launched by a local user with a long file name specified, a buffer overflow will be triggered. The following type of command arguments will trigger the overflow:

" -l AAAAAAAA....[455 char s]"

It is reported that on line 306 of snmpd.c, the following variable is defined:

char logfile[SNMP_MAXBUF_SMALL];

The value SNMP_MAXBUF_SMALL is reportedly defined in tools.h as a 512k buffer.

Then, on line 321 of snmpd.c, the following offending command results in the overflow:

strcpy(logfile, LOGFILE);

Impact:   A local user can execute arbitrary code on the host. If the snmpd is configured with set user id (suid) privileges, the local user could obtain elevated privileges.
Solution:   The vendor has released a fix. See the Source Message for the vendor's advisory containing directions on how to obtain the appropriate fix.
Vendor URL:  net-snmp.sourceforge.net/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)

Message History:   This archive entry is a follow-up to the message listed below.
Aug 4 2001 Net-snmp (formerly ucd-snmp) File Name Buffer Overflow Lets Local Users Execute Arbitrary Code



 Source Message Contents

Subject:  Security Update: [CSSA-2001-031.0] Linux -security issues in ucd-snmp


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
		   Caldera International, Inc.  Security Advisory

Subject:		Linux - security issues in ucd-snmp
Advisory number: 	CSSA-2001-031.0
Issue date: 		2001, August 16
Cross reference:
______________________________________________________________________________


1. Problem Description

   In a routine security audit of the ucd-snmp package we have found
   several problems, including several potentially exploitable buffer
   overflows, format string bugs, signedness issues and tempfile race
   conditions. Some of these might allow remote attackers to gain access
   to the UID under which snmpd is running. This update fixes all known
   problems and also makes the snmpd run as user 'nobody', reducing the
   impact of further problems.


2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux 2.3                 not vulnerable                
   
   OpenLinux eServer 2.3.1       All packages previous to      
   and OpenLinux eBuilder        ucd-snmp-4.2.1-6b             
   
   OpenLinux eDesktop 2.4        not vulnerable                
   
   OpenLinux Server 3.1          not vulnerable                
   
   OpenLinux Workstation 3.1     not vulnerable                
   

3. Solution

   Workaround

     none

   The proper solution is to upgrade to the latest packages.

4. OpenLinux 2.3

    not vulnerable

5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

    5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

       cb200e856acac6bd14fec9eb67eabb14  RPMS/ucd-snmp-4.2.1-6b.i386.rpm
       0c8f8963ce490f80a47681996e9370ab  RPMS/ucd-snmp-devel-4.2.1-6b.i386.rpm
       d584b6cd0b799b4b928dadce9f2ec058  RPMS/ucd-snmp-utils-4.2.1-6b.i386.rpm
       1e78df3f5bfce4319ce8e7622e45d795  SRPMS/ucd-snmp-4.2.1-6b.src.rpm
       

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

         rpm -Fvh ucd-snmp-4.2.1-6b.i386.rpm \
              ucd-snmp-devel-4.2.1-6b.i386.rpm \
              ucd-snmp-utils-4.2.1-6b.i386.rpm
         

6. OpenLinux eDesktop 2.4

    not vulnerable

7. OpenLinux 3.1 Server

    not vulnerable

8. OpenLinux 3.1 Workstation

    not vulnerable

9. References

   This and other Caldera security resources are located at:

   http://www.caldera.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 10043.


10. Disclaimer

   Caldera International, Inc. is not responsible for the misuse of
   any of the information we provide on this website and/or through our
   security advisories. Our advisories are a service to our customers
   intended to promote secure installation and use of Caldera OpenLinux.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7e8xX18sy83A/qfwRAo5PAJ9jSIigxzeYe8VQiITZDugLUTTY/wCff/ka
C7IXbFJO40v6YYKKTMdglFk=
=VFQ1
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@lists.caldera.com
For additional commands, e-mail: announce-help@lists.caldera.com


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC