lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 Nov 2015 22:29:01 +0900
From: Pierre Kim <>
To:, fulldisclosure <>
Subject: OpenBSD package 'net-snmp' information disclosure

Hash: SHA512

## Advisory Information

Title: OpenBSD package 'net-snmp' information disclosure
Advisory URL:
Blog URL:
Date published: 2015-11-12
Vendors contacted: Stuart Henderson, OpenBSD Package maintainer
Release mode: Released
CVE: CVE-2015-8100

## Product Description

Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and
SNMP v3 using both IPv4 and IPv6.

This software is available in OpenBSD as a port (/usr/ports/net/net-snmp).

## Vulnerabilities Summary

By default, when OpenBSD package and ports are used, the snmpd
configuration file
has weak permissions which allows a local user to retrieve sensitive

## Details

By default the permissions of the snmpd configuration file in OpenBSD
are 0644 instead of 0600:

  # cd /usr/ports/net/net-snmp
  # make install clean
  # ls -latr /etc/snmp/snmpd.conf
  -rw-r--r--  1 root  wheel  6993 Nov  4 09:16 /etc/snmp/snmpd.conf

The same problem occurs when the provided package is installed with

  # ls -latr /etc/snmp/snmpd.conf
  -rw-r--r--  1 root  wheel  6993 Nov  4 08:37 /etc/snmp/snmpd.conf

The snmpd configuration file is readable by a local user and contains
the credentials
for read-only and read-write access (for SNMPv1, SNMPv2 and SNMPv3
protocols) and
gives a local user unnecessary/dangerous access:


  rocommunity public  default    -V systemonly
  #rocommunity secret
  rouser   authOnlyUser
  #rwuser   authPrivUser   priv


This problem is OpenBSD-specific as the
/var/db/pkg/net-snmp-5.7.3p0/+CONTENTS file confirms:
  @ts 1438958635
  @sample /etc/snmp/snmpd.conf

Futhermore, by default, `/usr/local/sbin/snmpd` runs as root.

## Vendor Response

This problem has been fixed in the -STABLE and -CURRENT packages.

## Report Timeline

 * Nov 04, 2015: Vulnerability found by Pierre Kim.
 * Nov 06, 2015: Stuart Henderson is notified of the vulnerability.
 * Nov 06, 2015: Stuart Henderson confirms the vulnerability and fixes
the package permissions for the sample configuration file in -current
and -stable.
 * Nov 06, 2015: Stuart Henderson re-activates an option (can be
configured with rc.conf.local) to run net-snmp as a separate uid to
improve security.
 * Nov 10, 2015: OSS-Security is contacted to get a CVE
 * Nov 10, 2015: assigns CVE-2015-8100
 * Nov 12, 2015: A public advisory is sent to security mailing lists.

## Credit

This vulnerability was found by Pierre Kim (@PierreKimSec).

## References

## Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License:

Version: GnuPG v1


Pierre Kim

Powered by blists - more mailing lists