Ubuntu
net-snmp package

[net-snmp] remote Denial of Service vulnerability

Bug #164007 reported by disabled.user on 2007-11-20

256

	Status	Importance	Assigned to
net-snmp (Ubuntu)	Fix Released	Undecided	Stephan Rügamer
Dapper	Fix Released	Undecided	Unassigned
Edgy	Fix Released	Undecided	Unassigned
Feisty	Fix Released	Undecided	Unassigned
Gutsy	Fix Released	Undecided	Unassigned

Bug Description

Binary package hint: snmp

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846

Quoting:
"The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value."

Related branches

lp:ubuntu/dapper-updates/net-snmp

lp:ubuntu/edgy-updates/net-snmp

lp:ubuntu/feisty-security/net-snmp

lp:ubuntu/gutsy-security/net-snmp

CVE References

2007-5846

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-20:

Working on it

Changed in net-snmp:
assignee:	nobody → shermann
status:	New → Confirmed

Stephan Rügamer (sruegamer) on 2007-11-20

Changed in net-snmp:
status:	Confirmed → In Progress

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-20:

gutsy debdiff to fix this issue Edit (6.8 KiB, text/plain)

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-20:

Upstream is using this patch http://sourceforge.net/tracker/download.php?group_id=12694&atid=112694&file_id=228217&aid=1712988 for fixing this CVE.
I talked to Pitti about the introduction of two new configuration settings, which is done in this patch.

He agreed with me, that's the best way to go...the logic of the fix is sane and reproducable...so I think we can live with this patch....

Will work tomorrow morning on the other releases...and provide debdiffs...stay tuned :)

\sh

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-21:

feisty debdiff to fix this issue Edit (6.8 KiB, text/plain)

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-21:

edgy debdiff to fix this issue Edit (6.8 KiB, text/plain)

Revision history for this message

Stephan Rügamer (sruegamer) wrote on 2007-11-21:

dapper debdiff to fix this issue Edit (6.9 KiB, text/plain)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2008-01-09:

This bug was fixed in the package net-snmp - 5.3.1-6ubuntu2.1

---------------
net-snmp (5.3.1-6ubuntu2.1) gutsy-security; urgency=low

  * SECURITY UPDATE: CVE-2007-5846 (LP: #164007)
    The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to
    cause a denial of service (CPU and memory consumption) via a GETBULK request
    with a large max-repeaters value.
  * debian/patches/50_CVE-2007-5846.patch,
    debian/patches/50_CVE-2007-5846.README:
    Applied patch from upstream and explanation
    (Link: http://sourceforge.net/tracker/index.php?func=detail&aid=1712988&group_id=12694&atid=112694 )
  * References:
    CVE-2007-5846

-- Stephan Hermann <email address hidden> Tue, 20 Nov 2007 22:06:58 +0100

Changed in net-snmp:
status:	In Progress → Fix Released

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2009-08-25:

http://www.ubuntu.com/usn/usn-564-1

Changed in net-snmp (Ubuntu Dapper):
status:	New → Fix Released
Changed in net-snmp (Ubuntu Edgy):
status:	New → Fix Released
Changed in net-snmp (Ubuntu Feisty):
status:	New → Fix Released
Changed in net-snmp (Ubuntu Gutsy):
status:	New → Fix Released