Bug 855500 (CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808, CVE-2022-24809, CVE-2022-24810) – <net-analyzer/net-snmp-5.9.2: Multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2022-07-01 08:27:44 UTC]

+*5.9.2*:
+    security:
+      - These two CVEs can be exploited by a user with read-only credentials:
+          - CVE-2022-24805 A buffer overflow in the handling of the INDEX of
+            NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
+          - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable
+            can cause a NULL pointer dereference.
+      - These CVEs can be exploited by a user with read-write credentials:
+          - CVE-2022-24806 Improper Input Validation when SETing malformed
+            OIDs in master agent and subagent simultaneously
+          - CVE-2022-24807 A malformed OID in a SET request to
+            SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
+            out-of-bounds memory access.
+          - CVE-2022-24808 A malformed OID in a SET request to
+            NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
+          - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable
+            can cause a NULL pointer dereference.
+      - To avoid these flaws, use strong SNMPv3 credentials and do not share them.
+        If you must use SNMPv1 or SNMPv2c, use a complex community string
+        and enhance the protection by restricting access to a given IP address range.
+      - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for
+        reporting the following CVEs that have been fixed in this release, and
+        to Arista Networks for providing fixes.

[Comment 1 Larry the Git Cow 2022-07-01 08:41:12 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b2f6635d7773958a92d502d57fabd9edfa185d59

commit b2f6635d7773958a92d502d57fabd9edfa185d59
Author:     Sam James <[e-mail]>
AuthorDate: 2022-07-01 08:38:00 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-07-01 08:40:38 +0000

    net-analyzer/net-snmp: add 5.9.2
    
    Bug: https://bugs.gentoo.org/855500
    Signed-off-by: Sam James <[e-mail]>

 net-analyzer/net-snmp/Manifest                     |   1 +
 .../files/net-snmp-5.9.2-fix-LDFLAGS.patch         |  18 ++
 ...-snmp-99999999.ebuild => net-snmp-5.9.2.ebuild} |  29 ++-
 net-analyzer/net-snmp/net-snmp-9999.ebuild         | 224 +++++++++++++++++++++
 4 files changed, 263 insertions(+), 9 deletions(-)

[Comment 2 John Helmert III 2022-10-22 02:29:45 UTC]

GLSA request filed.

[Comment 3 Larry the Git Cow 2022-10-22 02:30:00 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a22e450ef84569ec67a970a6ea88ae5b017ee6b6

commit a22e450ef84569ec67a970a6ea88ae5b017ee6b6
Author:     John Helmert III <[e-mail]>
AuthorDate: 2022-10-22 02:29:21 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-22 02:29:21 +0000

    net-analyzer/net-snmp: drop 5.9.1-r2
    
    Bug: https://bugs.gentoo.org/855500
    Signed-off-by: John Helmert III <[e-mail]>

 net-analyzer/net-snmp/Manifest                 |   1 -
 net-analyzer/net-snmp/net-snmp-5.9.1-r2.ebuild | 218 -------------------------
 2 files changed, 219 deletions(-)

[Comment 4 Larry the Git Cow 2022-10-31 01:42:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=aa0a501598ae2bbf234180c0680abfbf0846cfac

commit aa0a501598ae2bbf234180c0680abfbf0846cfac
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-31 01:24:42 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-31 01:40:16 +0000

    [ GLSA 202210-29 ] Net-SNMP: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/855500
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-29.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

[Comment 5 John Helmert III 2022-10-31 02:18:35 UTC]

GLSA released, all done!