Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. An unauthenticated remote attacker could send specially crafted SNMPv3 traffic with a valid username and gain access to the user's views without a valid authentication passphrase. (CVE-2008-0960)

John Kortink discovered that the Net-SNMP Perl module did not correctly check the size of returned values. If a user or automated system were tricked into querying a malicious SNMP server, the application using the Perl module could be made to crash, leading to a denial of service. This did not affect Ubuntu 8.10. (CVE-2008-2292)

It was discovered that the SNMP service did not correctly handle large GETBULK requests. If an unauthenticated remote attacker sent a specially crafted request, the SNMP service could be made to crash, leading to a denial of service. (CVE-2008-4309).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0971 advisory.

    [5.3.1-24.2]
    - fix crash in bulk request processing (#469373)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SunOS 5.10: SMA patch.
Date this patch was last updated by Sun : Jun/30/11

The remote NewStart CGSL host, running version MAIN 5.04, has net-snmp packages installed that are affected by multiple vulnerabilities:

  - SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before     5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1;
    (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource     Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp     (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2;
    (6) SNMP Research before 16.2; (7) multiple Cisco IOS,     CatOS, ACE, and Nexus products; (8) Ingate Firewall     3.1.0 and later and SIParator 3.1.0 and later; (9) HP     OpenView SNMP Emanate Master Agent 15.x; and possibly     other products relies on the client to specify the HMAC     length, which makes it easier for remote attackers to     bypass SNMP authentication via a length value of 1,     which only checks the first byte. (CVE-2008-0960)

  - Buffer overflow in the __snprint_value function in     snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in     SNMP.xs for Perl, allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a large OCTETSTRING in an attribute value pair     (AVP). (CVE-2008-2292)

  - Integer overflow in the netsnmp_create_subtree_cache     function in agent/snmp_agent.c in net-snmp 5.4 before     5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1     allows remote attackers to cause a denial of service     (crash) via a crafted SNMP GETBULK request, which     triggers a heap-based buffer overflow, related to the     number of responses or repeats. (CVE-2008-4309)

  - The netsnmp_udp_fmtaddr function     (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through     5.4.2.1, when using TCP wrappers for client     authorization, does not properly parse hosts.allow     rules, which allows remote attackers to bypass intended     access restrictions and execute SNMP queries, related to     source/destination IP address confusion.
    (CVE-2008-6123)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Tue Jul 22 2008 Jan Safranek <jsafranek at redhat.com>     5.4.1-19

    - fix perl SNMP::Session::set (#452131)

    - support interface names longer than 8 characters       (#468045)

    - explicitly require the right version and release of       net-snmp and net-snmp-libs

  - fix CVE-2008-4309

    - Tue Jun 10 2008 Jan Safranek <jsafranek at redhat.com>       5.4.1-18

    - explicitly require lm_sensor > 3 for build (#442718)

    - fix various flaws (CVE-2008-2292 CVE-2008-0960)

    - Sat May 31 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-17

    - fix sparc handling in /usr/bin/net-snmp-config

    - Thu May 29 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-16

    - fix /usr/include/net-snmp-config.h for sparc

    - Sun May 25 2008 Dennis Gilmore <dennis at ausil.us>       5.4.1-15

    - sparc multilib handling

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Remote attackers could crash net-snmp via GETBULK-Request.
(CVE-2008-4309)

In addition the following non-security issues have been fixed :

  - typo in error message. (bnc#439857)

  - fix duplicate registration warnings on startup.
    (bnc#326957)

  - container insert errors reproducable with shared ip     setups. (bnc#396773)

  - typo in the snmpd init script to really load all agents.
    (bnc#415127)

  - logrotate config to restart the snmptrapd aswell.
    (bnc#378069)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
38099	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : net-snmp vulnerabilities (USN-685-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	critical
67761	Oracle Linux 5 : net-snmp (ELSA-2008-0971)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	high
107359	Solaris 10 (sparc) : 120272-31	Nessus	Solaris Local Security Checks	2018/3/12	2026/1/15	critical
127171	NewStart CGSL MAIN 5.04 : net-snmp Multiple Vulnerabilities (NS-SA-2019-0017)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2026/1/15	critical
34704	Fedora 9 : net-snmp-5.4.1-19.fc9 (2008-9367)	Nessus	Fedora Local Security Checks	2008/11/6	2021/1/11	medium
35460	SuSE 10 Security Update : net-snmp (ZYPP Patch Number 5807)	Nessus	SuSE Local Security Checks	2009/1/26	2021/1/14	medium

检测

插件搜索

critical

high

critical

critical

medium

medium