CLD-318 Details

Other IDs this deficiency may be known by:

CVE ID	CVE-2018-1000116 (nvd) (mitre) (debian) (archlinux) (red hat) (suse) (ubuntu)
Other ID(s)

Basic Information:

Affected Package(s)	net-snmp
Deficiency Type	SECURITY
Date Created	2018-03-07 13:32:41
Date Last Modified	2018-03-07 15:13:54

Version Specific Information:

Cucumber 1.0 i686	fixed in net-snmp-5.7.3-i686-2
Cucumber 1.0 x86_64	fixed in net-snmp-5.7.3-x86_64-2 and net-snmp-lib_i686-5.7.3-lib_i686-2

Cucumber 1.1 i686	fixed in net-snmp-5.7.3-i686-3
Cucumber 1.1 x86_64	fixed in net-snmp-5.7.3-x86_64-3 and net-snmp-lib_i686-5.7.3-lib_i686-3

Details:

=================================== Overview ===================================

NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP
protocol handler that can result in command execution. 

================================ Initial Report ================================

From https://sourceforge.net/p/net-snmp/bugs/2821/:

NET-SNMP is a service listening on a UDP port which provides useful information
to administrators related to the network, the CPU activity or the memory
currently used. It is usually polled in order to perform various sanity checks
using home made scripts. Access to this service is restricted using a community
secret (v1 and v2c of the protocol) or a more complex authentication process
(v3).

The version 5.7.2 was vulnerable to a heap corruption within the parsing of the
PDU prior to the authentication process.

Details given in the attached document

https://sourceforge.net/p/net-snmp/bugs/2821/attachment/SNMP_SecurityIssue.docx

================================= Our Analysis =================================

----- Affected Products -----
Net-snmp version 5.7.3 (as originally packaged in Cucumber Linux) is vulnerable
to this. This includes the origianl version of net-snmp in Cucumber Linux 1.0
and 1.1.

----- Scope and Impact of this Vulnerability -----
Allows for remote code execution.

----- Fix for this Vulnerability -----
Fixed in
https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/tree/snmplib/snmp_api.c?diff=dba5362b9fc262d66e4dcc9de2a9d4e84a900a92

================================= Our Solution =================================

We have applied a modified version of the aforementioned patch and rebuilt. The
modified patch can be found at:
http://mirror.cucumberlinux.com/cucumber/cucumber-1.1/source/net-general/net-snmp/patches/00020_CVE-2018-1000116_f23bcd3ac6ddee5d0a48f9703007ccc738914791.patch