Resolves: #2141902 - fix CVE-2022-44792
Resolves: #2141906 - fix CVE-2022-44793
This commit is contained in:
Josef Řídký
parent
2efdd20268
commit
39c74035d5
129
net-snmp-5.9-CVE-2022-44792-44793.patch
Normal file
129
net-snmp-5.9-CVE-2022-44792-44793.patch
Normal file
@ -0,0 +1,129 @@
|
|||||||
|
From 4589352dac3ae111c7621298cf231742209efd9b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bill Fenner <fenner@gmail.com>
|
||||||
|
Date: Fri, 25 Nov 2022 08:41:24 -0800
|
||||||
|
Subject: [PATCH 1/3] snmp_agent: disallow SET with NULL varbind
|
||||||
|
|
||||||
|
---
|
||||||
|
agent/snmp_agent.c | 32 ++++++++++++++++++++++++++++++++
|
||||||
|
1 file changed, 32 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
|
||||||
|
index 867d0c166f..3f678fe2df 100644
|
||||||
|
--- a/agent/snmp_agent.c
|
||||||
|
+++ b/agent/snmp_agent.c
|
||||||
|
@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status)
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int
|
||||||
|
+check_set_pdu_for_null_varbind(netsnmp_agent_session *asp)
|
||||||
|
+{
|
||||||
|
+ int i;
|
||||||
|
+ netsnmp_variable_list *v = NULL;
|
||||||
|
+
|
||||||
|
+ for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) {
|
||||||
|
+ if (v->type == ASN_NULL) {
|
||||||
|
+ /*
|
||||||
|
+ * Protect SET implementations that do not protect themselves
|
||||||
|
+ * against wrong type.
|
||||||
|
+ */
|
||||||
|
+ DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i));
|
||||||
|
+ asp->index = i;
|
||||||
|
+ return SNMP_ERR_WRONGTYPE;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ return SNMP_ERR_NOERROR;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
int
|
||||||
|
handle_pdu(netsnmp_agent_session *asp)
|
||||||
|
{
|
||||||
|
int status, inclusives = 0;
|
||||||
|
netsnmp_variable_list *v = NULL;
|
||||||
|
|
||||||
|
+#ifndef NETSNMP_NO_WRITE_SUPPORT
|
||||||
|
+ /*
|
||||||
|
+ * Check for ASN_NULL in SET request
|
||||||
|
+ */
|
||||||
|
+ if (asp->pdu->command == SNMP_MSG_SET) {
|
||||||
|
+ status = check_set_pdu_for_null_varbind(asp);
|
||||||
|
+ if (status != SNMP_ERR_NOERROR) {
|
||||||
|
+ return status;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif /* NETSNMP_NO_WRITE_SUPPORT */
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* for illegal requests, mark all nodes as ASN_NULL
|
||||||
|
*/
|
||||||
|
|
||||||
|
From 7f4ac4051cc7fec6a5944661923acb95cec359c7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bill Fenner <fenner@gmail.com>
|
||||||
|
Date: Fri, 25 Nov 2022 08:41:46 -0800
|
||||||
|
Subject: [PATCH 2/3] apps: snmpset: allow SET with NULL varbind for testing
|
||||||
|
|
||||||
|
---
|
||||||
|
apps/snmpset.c | 1 +
|
||||||
|
1 file changed, 1 insertion(+)
|
||||||
|
|
||||||
|
diff --git a/apps/snmpset.c b/apps/snmpset.c
|
||||||
|
index 48e14bd513..d542713e1b 100644
|
||||||
|
--- a/apps/snmpset.c
|
||||||
|
+++ b/apps/snmpset.c
|
||||||
|
@@ -182,6 +182,7 @@ main(int argc, char *argv[])
|
||||||
|
case 'x':
|
||||||
|
case 'd':
|
||||||
|
case 'b':
|
||||||
|
+ case 'n': /* undocumented */
|
||||||
|
#ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES
|
||||||
|
case 'I':
|
||||||
|
case 'U':
|
||||||
|
|
||||||
|
From 15f9d7f7e5b90c9b419832ed8e6413feb6570d83 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Bill Fenner <fenner@gmail.com>
|
||||||
|
Date: Fri, 25 Nov 2022 10:23:32 -0800
|
||||||
|
Subject: [PATCH 3/3] Add test for NULL varbind set
|
||||||
|
|
||||||
|
---
|
||||||
|
.../default/T0142snmpv2csetnull_simple | 31 +++++++++++++++++++
|
||||||
|
1 file changed, 31 insertions(+)
|
||||||
|
create mode 100644 testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||||
|
|
||||||
|
diff --git a/testing/fulltests/default/T0142snmpv2csetnull_simple b/testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..0f1b8f386b
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||||
|
@@ -0,0 +1,31 @@
|
||||||
|
+#!/bin/sh
|
||||||
|
+
|
||||||
|
+. ../support/simple_eval_tools.sh
|
||||||
|
+
|
||||||
|
+HEADER SNMPv2c set of system.sysContact.0 with NULL varbind
|
||||||
|
+
|
||||||
|
+SKIPIF NETSNMP_DISABLE_SET_SUPPORT
|
||||||
|
+SKIPIF NETSNMP_NO_WRITE_SUPPORT
|
||||||
|
+SKIPIF NETSNMP_DISABLE_SNMPV2C
|
||||||
|
+SKIPIFNOT USING_MIBII_SYSTEM_MIB_MODULE
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Begin test
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+# standard V2C configuration: testcomunnity
|
||||||
|
+snmp_write_access='all'
|
||||||
|
+. ./Sv2cconfig
|
||||||
|
+STARTAGENT
|
||||||
|
+
|
||||||
|
+CAPTURE "snmpget -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0"
|
||||||
|
+
|
||||||
|
+CHECK ".1.3.6.1.2.1.1.4.0 = STRING:"
|
||||||
|
+
|
||||||
|
+CAPTURE "snmpset -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0 n x"
|
||||||
|
+
|
||||||
|
+CHECK "Reason: wrongType"
|
||||||
|
+
|
||||||
|
+STOPAGENT
|
||||||
|
+
|
||||||
|
+FINISHED
|
||||||
|
|
||||||
@ -10,7 +10,7 @@
|
|||||||
Summary: A collection of SNMP protocol tools and libraries
|
Summary: A collection of SNMP protocol tools and libraries
|
||||||
Name: net-snmp
|
Name: net-snmp
|
||||||
Version: 5.9.1
|
Version: 5.9.1
|
||||||
Release: 8%{?dist}
|
Release: 9%{?dist}
|
||||||
Epoch: 1
|
Epoch: 1
|
||||||
|
|
||||||
License: BSD
|
License: BSD
|
||||||
@ -52,6 +52,7 @@ Patch22: net-snmp-5.9-ECC-cert.patch
|
|||||||
Patch23: net-snmp-5.9-intermediate-certs.patch
|
Patch23: net-snmp-5.9-intermediate-certs.patch
|
||||||
Patch24: net-snmp-5.9-twice-IP-parsing.patch
|
Patch24: net-snmp-5.9-twice-IP-parsing.patch
|
||||||
Patch25: net-snmp-5.9-openssl-3.0.patch
|
Patch25: net-snmp-5.9-openssl-3.0.patch
|
||||||
|
Patch26: net-snmp-5.9-CVE-2022-44792-44793.patch
|
||||||
|
|
||||||
# Modern RPM API means at least EL6
|
# Modern RPM API means at least EL6
|
||||||
Patch101: net-snmp-5.8-modern-rpm-api.patch
|
Patch101: net-snmp-5.8-modern-rpm-api.patch
|
||||||
@ -229,6 +230,7 @@ cp %{SOURCE10} .
|
|||||||
%patch23 -p1 -b .intermediate-certs
|
%patch23 -p1 -b .intermediate-certs
|
||||||
%patch24 -p1 -b .twice-IP-parsing
|
%patch24 -p1 -b .twice-IP-parsing
|
||||||
%patch25 -p1 -b .openssl-3-0
|
%patch25 -p1 -b .openssl-3-0
|
||||||
|
%patch26 -p1 -b .CVE-2022-44792-44793
|
||||||
|
|
||||||
%patch101 -p1 -b .modern-rpm-api
|
%patch101 -p1 -b .modern-rpm-api
|
||||||
%patch102 -p1
|
%patch102 -p1
|
||||||
@ -498,6 +500,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
|
|||||||
%{_libdir}/libnetsnmptrapd*.so.%{soname}*
|
%{_libdir}/libnetsnmptrapd*.so.%{soname}*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Feb 15 2023 Josef Ridky <jridky@redhat.com> - 1:5.9.1-9
|
||||||
|
- fix CVE-2022-44792 and CVE-2022-44793 (#2141902) and (#2141906)
|
||||||
|
|
||||||
* Thu Apr 07 2022 Josef Ridky <jridky@redhat.com> - 1:5.9.1-8
|
* Thu Apr 07 2022 Josef Ridky <jridky@redhat.com> - 1:5.9.1-8
|
||||||
- fix default snmpd.conf file content (#2067954)
|
- fix default snmpd.conf file content (#2067954)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user