Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 12 Feb 2009 10:56:42 -0500 (EST)
From: "Steven M. Christey" <>
To: oss-security <>,
        oss-security <>
cc: "Steven M. Christey" <>
Subject: Re: CVE Request -- net-snmp (sensitive host information

I'm confused by the upstream diff being referenced by the Red Hat bug ID.
Specifically, it looks like some sprintf's got changed, and the result is
used for logging.  Is it certain that the attacker can bypass
authorization, or is net-snmp just mis-reporting it?

I'm going with authorization bypass at the moment.

Name: CVE-2008-6123
Status: Candidate
Reference: MLIST:[oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
Reference: URL:
Reference: CNFIRM:
Reference: CONFIRM:
Reference: CONFIRM:
Reference: MISC:

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp
5.0.9 through 5.4.2, when using TCP wrappers for client authorization,
does not properly parse hosts.allow rules, which allows remote
attackers to bypass intended access restrictions and execute SNMP
queries, related to "source/destination IP address confusion."

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.