Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 431752 (CVE-2012-2141) - <net-analyzer/net-snmp-5.7.2_rc1: Denial of Service (CVE-2012-2141)
Summary: <net-analyzer/net-snmp-5.7.2_rc1: Denial of Service (CVE-2012-2141)
Status: RESOLVED FIXED
Alias: CVE-2012-2141
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa]
Keywords:
Depends on: 432004 432926
Blocks:
  Show dependency tree
 
Reported: 2012-08-17 15:28 UTC by GLSAMaker/CVETool Bot
Modified: 2014-09-01 21:49 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2012-08-17 15:28:01 UTC
CVE-2012-2141 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2141):
  Array index error in the handle_nsExtendOutput2Table function in
  agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated
  users to cause a denial of service (out-of-bounds read and snmpd crash) via
  an SNMP GET request for an entry not in the extension table.


Upstream has fixed the issue in all branches.

Upstream bug:
http://sourceforge.net/tracker/index.php?func=detail&aid=3526549&group_id=12694&atid=112694

Upstream commit: 
http://net-snmp.git.sourceforge.net/git/gitweb.cgi?p=net-snmp/net-snmp;a=commitdiff;h=4c5633f1603e4bd03ed05c37d782ec8911759c47
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2012-08-19 02:24:32 UTC
net-snmp 5.7.2_rc1 is in tree and has this fixed.
Comment 2 Tim Sammut (RETIRED) gentoo-dev 2012-08-19 17:13:08 UTC
Thanks, Diego. Ok to stable the _rc here now?
Comment 3 Diego Elio Pettenò (RETIRED) gentoo-dev 2012-08-19 17:15:33 UTC
Given what I see from the older versions, I'd say so. I tried it out here on our devel servers and sounds good.
Comment 4 Tim Sammut (RETIRED) gentoo-dev 2012-08-19 17:17:34 UTC
Great, thanks.

Arches, please test and mark stable:
=net-analyzer/net-snmp-5.7.2_rc1
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 5 Agostino Sarubbo gentoo-dev 2012-08-20 09:55:05 UTC
amd64 stable
Comment 6 Jeroen Roovers (RETIRED) gentoo-dev 2012-08-20 17:06:50 UTC
Stable for HPPA.
Comment 7 Johannes Huber gentoo-dev 2012-08-20 21:18:49 UTC
x86 stable
Comment 8 Raúl Porcel (RETIRED) gentoo-dev 2012-08-26 16:10:43 UTC
alpha/arm/ia64/s390/sh/sparc stable
Comment 9 Brent Baude (RETIRED) gentoo-dev 2012-08-28 18:17:59 UTC
ppc64 done
Comment 10 Brent Baude (RETIRED) gentoo-dev 2012-10-05 17:03:40 UTC
ppc done
Comment 11 edoceo 2012-10-22 23:34:34 UTC
Hey, the pci USE flag has disappeared in rc1.

I run my Gentoo systems on Linode and their supplied kernels don't have 

CONFIG_PCI=y

And what's crazy is that when /proc/bus/pci is empty it causes snmpd to not run, it exit (status 1) when trying.

---
~ # snmpd
pcilib: Cannot open /proc/bus/pci
pcilib: Cannot find any working access method.
---

But if the $(use_with pci) use flag code is added back to the mix then we can build w/o PCI links and run on machines that don't have PCI enabled in the kernel (which I think is odd)
Comment 12 Diego Elio Pettenò (RETIRED) gentoo-dev 2012-10-23 01:53:16 UTC
Please don't hijack bugs.

That's been fixed in later ebuilds including 5.7.1 final.
Comment 13 edoceo 2012-10-24 17:32:30 UTC
Apologies for the hi-jack; I made a new bug to bring back PCI use flag

https://bugs.gentoo.org/show_bug.cgi?id=439534
Comment 14 Sean Amoss (RETIRED) gentoo-dev Security 2012-10-25 12:50:49 UTC
Thanks, everyone.

GLSA vote: yes.
Comment 15 Tim Sammut (RETIRED) gentoo-dev 2012-12-11 17:40:41 UTC
GLSA Vote: yes too. Request filed.
Comment 16 GLSAMaker/CVETool Bot gentoo-dev 2014-09-01 21:49:36 UTC
This issue was resolved and addressed in
 GLSA 201409-02 at http://security.gentoo.org/glsa/glsa-201409-02.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).