bugtraq - OpenLinux: ucd-snmp remote heap overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20031107124720.A20158@caldera.com>
Date: Fri, 7 Nov 2003 12:47:20 -0800
From: security@....com
To: announce@...ts.caldera.com, bugtraq@...urityfocus.com,
   full-disclosure@...ts.netsys.com, security-alerts@...uxsecurity.com
Subject: OpenLinux: ucd-snmp remote heap overflow



To: announce@...ts.caldera.com bugtraq@...urityfocus.com full-disclosure@...ts.netsys.com security-alerts@...uxsecurity.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenLinux: ucd-snmp remote heap overflow
Advisory number: 	CSSA-2003-029.0
Issue date: 		2003 October 30
Cross reference:	sr883603 fz528212 erg712406 CAN-2002-1570
______________________________________________________________________________


1. Problem Description

	ucd-snmp is a set of tools relating to the Simple Network
	Management Protocol (SNMP), which is used for remote
	administration and monitoring of network devices and
	lervices. 
	
	Juan M. de la Torre found a remote heap overflow
	vulnerability in snmpnetstat (a tool used to retrieve information
	about a remote host). When a list of interfaces is requested, a
	malicious server can return information in a way that will cause
	a heap overflow in snmpnetstat. A remote atacker able to control
	a snmp server can exploit this vulnerability to execute arbitrary
	code with the privileges of the user running snmpnetstat.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to ucd-snmp-4.2.1-18.i386.rpm
					prior to ucd-snmp-devel-4.2.1-18.i386.rpm
					prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm
					prior to ucd-snmp-utils-4.2.1-18.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to ucd-snmp-4.2.1-18.i386.rpm
					prior to ucd-snmp-devel-4.2.1-18.i386.rpm
					prior to ucd-snmp-tkmib-4.2.1-18.i386.rpm
					prior to ucd-snmp-utils-4.2.1-18.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/RPMS

	4.2 Packages

	126ee06bd94f366289364150ed7d87fb	ucd-snmp-4.2.1-18.i386.rpm
	6653905d5244636d0a699c48d447d627	ucd-snmp-devel-4.2.1-18.i386.rpm
	947bf938d44ea9d03a5d2d242244855c	ucd-snmp-tkmib-4.2.1-18.i386.rpm
	ec04d382fd0010911277e7635b2312b7	ucd-snmp-utils-4.2.1-18.i386.rpm

	4.3 Installation

	rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-029.0/SRPMS

	4.5 Source Packages

	adcdbf58ba2b5ef0075c46fcc80dc399	ucd-snmp-4.2.1-18.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/RPMS

	5.2 Packages

	126ee06bd94f366289364150ed7d87fb	ucd-snmp-4.2.1-18.i386.rpm
	6653905d5244636d0a699c48d447d627	ucd-snmp-devel-4.2.1-18.i386.rpm
	947bf938d44ea9d03a5d2d242244855c	ucd-snmp-tkmib-4.2.1-18.i386.rpm
	ec04d382fd0010911277e7635b2312b7	ucd-snmp-utils-4.2.1-18.i386.rpm

	5.3 Installation

	rpm -Fvh ucd-snmp-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-devel-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-tkmib-4.2.1-18.i386.rpm
	rpm -Fvh ucd-snmp-utils-4.2.1-18.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-029.0/SRPMS

	5.5 Source Packages

	adcdbf58ba2b5ef0075c46fcc80dc399	ucd-snmp-4.2.1-18.src.rpm


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1570

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr883603 fz528212
	erg712406.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	SCO would like to thank	Juan M. de la Torre for reporting this issue.
______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (SCO/UNIX_SVR5)

iD8DBQE/rARmbluZssSXDTERAtlUAJ9figxbsL6A/Nd5QwJjqAD87xi04gCgwLHK
/qExdik2m3lWQrKFheX+GoU=
=fKrF
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html