SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Net-snmp Vendors:   [Multiple Authors/Vendors]
(FreeBSD Issues Fix) Many Simple Network Management Protocol (SNMP) Implementations Allow Remote Users to Deny Service or Obtain Access to the System
SecurityTracker Alert ID:  1003530
SecurityTracker URL:  http://securitytracker.com/id/1003530
CVE Reference:   CVE-2002-0012, CVE-2002-0013   (Links to External Site)
Date:  Feb 13 2002
Impact:   Denial of service via network, Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 4.2.3
Description:   CERT reported that the University of Oulu (Finland) has discovered vulnerabilities in many vendor implementations of the Simple Network Management Protocol (SNMP) version 1.

The Oulu University Secure Programming Group (OUSPG, http://www.ee.oulu.fi/research/ouspg/) reports that there are numerous vulnerabilities in SNMPv1 implementations from many different vendors. A remote user can reportedly cause denial of service attacks or gain elevated privileges on the system.

The extent of the vulnerabilities depends on the specific vendor implementation. Vulnerabilities apparently include denial-of-service conditions, format string vulnerabilities, and buffer overflows. Some vulnerabilities do not require the request message to use the correct SNMP community string, according to CERT.

OUSPG reportedly performed two sets of tests of SNMP request message handling: one test focused on ASN.1 decoding, and the second looked for exceptions in the processing of the decoded data. The testers used the PROTOS c06-snmpv1 test suite:

http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/0100.html

Some of the products implement defective SNMPv1 trap handling. A remote user can reportedly send a specially crafted SNMP trap message to an SNMP manager to trigger the vulnerability.

Some of the products implement defective SNMPv1 request handling. A remote user can reportedly send a specially crafted SNMP request message to an SNMP agent to trigger the vulnerability.

Specific technical results were not available at the time of this entry. However, CERT reports that the following vendors are affected to some degree:

3Com,
AdventNet,
CacheFlow,
Caldera,
Cisco,
Compaq,
Computer Associates,
COMTEK Services,
FreeBSD,
Hewlett Packard,
Hirschmann Electronics,
Innerdive Solutions,
Juniper Networks,
Lantronix,
Lotus,
Lucent,
Marconi,
Microsoft,
Multinet,
Netscape,
NET-SNMP,
Nokia,
Novell,
Red Hat,
Redback Networks,
SNMP Research

CERT has provided more information at the following URLs:

http://www.kb.cert.org/vuls/id/854306
http://www.kb.cert.org/vuls/id/107186

Impact:   A remote user may be able to cause denial of service conditions or may be able to obtain elevated privileges on the system.
Solution:   The vendor has released a fix for net-snmp in the FreeBSD ports collection.

The vendor has provided the following solution options:

1) Upgrade your entire ports collection and rebuild the port.

2) Deinstall the old package and install a new package dated after the correction date, obtained from the following directories:

[i386]
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/ucd-snmp-4.2.3.tgz

[alpha]
Packages are not automatically generated for the alpha architecture at this time due to lack of build resources.

3) Download a new port skeleton for the net-snmp port from:

http://www.freebsd.org/ports/

and use it to rebuild the port.

4) Use the portcheckout utility to automate option (3) above. The portcheckout port is available in /usr/ports/devel/portcheckout or the package can be obtained from:

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/Latest/portcheckout.tgz

NOTE: Many other applications utilize the Net-SNMP libraries. These applications may also be vulnerable. It is recommended that such applications be rebuilt after upgrading Net-SNMP. The following command will display applications installed by the FreeBSD ports collection that utilize Net-SNMP:

pkg_info -R ucd-snmp-\*

See the Source Message for the vendor's advisory containing directions on how to apply the appropriate fix.

Cause:   Access control error, Boundary error, Input validation error
Underlying OS:  UNIX (FreeBSD)

Message History:   This archive entry is a follow-up to the message listed below.
Feb 12 2002 Many Simple Network Management Protocol (SNMP) Implementations Allow Remote Users to Deny Service or Obtain Access to the System



 Source Message Contents

Subject:  FreeBSD Ports Security Advisory FreeBSD-SA-02:11.snmp


-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-02:11                                            Security Advisory
                                                                FreeBSD, Inc.

Topic:          ucd-snmp/net-snmp remotely exploitable vulnerabilities

Category:       ports
Module:         net-snmp
Announced:      2002-02-12
Credits:        OUSPG: Oulu University Secure Programming Group
                http://www.ee.oulu.fi/research/ouspg/
Affects:        Ports collection prior to the correction date
Corrected:      2002-01-21 16:54:50 UTC
FreeBSD only:   NO
CERT:           CA-2002-03

I.   Background

The Net-SNMP (previously known as UCD-SNMP) package is a set of Simple
Network Management Protocol tools, including an agent, library, and
applications for generating and handling requests and traps.

NOTE: The Net-SNMP port directory is ports/net/net-snmp, but the
package name is still ucd-snmp.

II.  Problem Description

The Net-SNMP port, versions prior to 4.2.3, contains several remotely
exploitable vulnerabilities.  The OUSPG has discovered vulnerabilities
in many SNMPv1 implementations through their `PROTOS - Security
Testing of Protocol Implementations' project.  The vulnerabilities are
numerous and affect SNMPv1 request and trap handling in both managers
and agents.  Please refer to the References section for complete
details.

The Net-SNMP port is not installed by default, nor is it "part of
FreeBSD" as such: it is part of the FreeBSD ports collection, which
contains over 6000 third-party applications in a ready-to-install
format. The ports collection shipped with FreeBSD 4.5 does not
contains this problem.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security
audit of the most security-critical ports.

III. Impact

Although no exploits are known to exist at this time, the
vulnerabilities may be exploited by a remote attacker in order to
cause the SNMP agent to execute arbitrary code with superuser
privileges.  Malicious agents may respond to requests with specially
constructed replies that cause arbitrary code to be executed by the
client.  Knowledge of the SNMP community name is unnecessary for such
exploits to be effective.


IV.  Workaround

1) Deinstall the ucd-snmp port/package if you have it installed.

V.   Solution

Do one of the following:

1) Upgrade your entire ports collection and rebuild the port.

2) Deinstall the old package and install a new package dated after the
correction date, obtained from the following directories:

[i386]
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/ucd-snmp-4.2.3.tgz

[alpha]
Packages are not automatically generated for the alpha architecture at
this time due to lack of build resources.

3) Download a new port skeleton for the net-snmp port from:

http://www.freebsd.org/ports/

and use it to rebuild the port.

4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/Latest/portcheckout.tgz

NOTE: Many other applications utilize the Net-SNMP libraries.  These
applications may also be vulnerable.  It is recommended that such
applications be rebuilt after upgrading Net-SNMP.  The following
command will display applications installed by the FreeBSD ports
collection that utilize Net-SNMP:

  pkg_info -R ucd-snmp-\*

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in the FreeBSD ports collection.

Path                                                             Revision
- -------------------------------------------------------------------------
ports/net/net-snmp/Makefile                                          1.59
ports/net/net-snmp/distinfo                                          1.15
ports/net/net-snmp/pkg-plist                                         1.18
ports/net/net-snmp/files/freebsd4.h                             (removed)
ports/net/net-snmp/files/patch-aclocal.m4                             1.1
- -------------------------------------------------------------------------

VII. References

<URL:http://www.cert.org/advisories/CA-2002-03.html>
<URL:http://www.ee.oulu.fi/research/ouspg/protos/>
<URL:http://www.kb.cert.org/vuls/id/107186>
<URL:http://www.kb.cert.org/vuls/id/854306>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iQCUAwUBPGmij1UuHi5z0oilAQGFQgP4ku0xC5v8hKJBXYbiSXmwVDpHpV6WHIWP
zuTSiyvKbUX7nKm6c9IMB+5ep2/SGdJXxWos+YZcncv8VgR5i47K1M1dYXwwniRg
dZMY/a2lL3B8902bHQq4zpR0TrgE7Wp1IhRNAeS8SZw1pnW86pgLsQzIr6WYhpzM
rgiaaaG+AQ==
=VdS0
-----END PGP SIGNATURE-----

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security-notifications" in the body of the message


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC