From 097236ba27d5662b5d7f07c766c4759d014d632e173f3730fc4e21ed5f95425b Mon Sep 17 00:00:00 2001 From: Dominique Leuenberger Date: Sun, 13 Sep 2015 07:42:41 +0000 Subject: [PATCH] Accepting request 328754 from net-snmp:factory - reenabled md5 and des, as some tools build against it and need the methods :( (forwarded request 328750 from msmeissn) OBS-URL: https://build.opensuse.org/request/show/328754 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/net-snmp?expand=0&rev=77 --- ...-5.7.3-fix-snmp_pdu_parse-incomplete.patch | 120 ++++++++++++++++++ net-snmp.changes | 20 +++ net-snmp.spec | 2 + 3 files changed, 142 insertions(+) create mode 100644 net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch diff --git a/net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch b/net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch new file mode 100644 index 0000000..2cbab97 --- /dev/null +++ b/net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch @@ -0,0 +1,120 @@ +diff -Nurp net-snmp-5.7.3.pre5-orig/snmplib/snmp_api.c net-snmp-5.7.3.pre5/snmplib/snmp_api.c +--- net-snmp-5.7.3.pre5-orig/snmplib/snmp_api.c 2015-08-13 21:33:38.835653065 +0200 ++++ net-snmp-5.7.3.pre5/snmplib/snmp_api.c 2015-08-13 21:54:03.099348588 +0200 +@@ -4350,10 +4350,9 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char + u_char type; + u_char msg_type; + u_char *var_val; +- int badtype = 0; + size_t len; + size_t four; +- netsnmp_variable_list *vp = NULL; ++ netsnmp_variable_list *vp = NULL, *vplast = NULL; + oid objid[MAX_OID_LEN]; + u_char *p; + +@@ -4493,38 +4492,24 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char + (ASN_SEQUENCE | ASN_CONSTRUCTOR), + "varbinds"); + if (data == NULL) +- return -1; ++ goto fail; + + /* + * get each varBind sequence + */ + while ((int) *length > 0) { +- netsnmp_variable_list *vptemp; +- vptemp = (netsnmp_variable_list *) malloc(sizeof(*vptemp)); +- if (NULL == vptemp) { +- return -1; +- } +- if (NULL == vp) { +- pdu->variables = vptemp; +- } else { +- vp->next_variable = vptemp; +- } +- vp = vptemp; ++ vp = SNMP_MALLOC_TYPEDEF(netsnmp_variable_list); ++ if (NULL == vp) ++ goto fail; + +- vp->next_variable = NULL; +- vp->val.string = NULL; + vp->name_length = MAX_OID_LEN; +- vp->name = NULL; +- vp->index = 0; +- vp->data = NULL; +- vp->dataFreeHook = NULL; + DEBUGDUMPSECTION("recv", "VarBind"); + data = snmp_parse_var_op(data, objid, &vp->name_length, &vp->type, + &vp->val_len, &var_val, length); + if (data == NULL) +- return -1; ++ goto fail; + if (snmp_set_var_objid(vp, objid, vp->name_length)) +- return -1; ++ goto fail; + + len = MAX_PACKET_LENGTH; + DEBUGDUMPHEADER("recv", "Value"); +@@ -4604,7 +4589,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char + vp->val.string = (u_char *) malloc(vp->val_len); + } + if (vp->val.string == NULL) { +- return -1; ++ goto fail; + } + p = asn_parse_string(var_val, &len, &vp->type, vp->val.string, + &vp->val_len); +@@ -4619,7 +4604,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char + vp->val_len *= sizeof(oid); + vp->val.objid = (oid *) malloc(vp->val_len); + if (vp->val.objid == NULL) { +- return -1; ++ goto fail; + } + memmove(vp->val.objid, objid, vp->val_len); + break; +@@ -4631,21 +4616,37 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char + case ASN_BIT_STR: + vp->val.bitstring = (u_char *) malloc(vp->val_len); + if (vp->val.bitstring == NULL) { +- return -1; ++ goto fail; + } + p = asn_parse_bitstring(var_val, &len, &vp->type, + vp->val.bitstring, &vp->val_len); + if (!p) +- return -1; ++ goto fail; + break; + default: + snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type); +- badtype = -1; ++ goto fail; + break; + } + DEBUGINDENTADD(-4); ++ ++ if (NULL == vplast) { ++ pdu->variables = vp; ++ } else { ++ vplast->next_variable = vp; ++ } ++ vplast = vp; ++ vp = NULL; + } +- return badtype; ++ return 0; ++ ++ fail: ++ DEBUGMSGTL(("recv", "error while parsing VarBindList\n")); ++ /** if we were parsing a var, remove it from the pdu and free it */ ++ if (vp) ++ snmp_free_var(vp); ++ ++ return -1; + } + + /* diff --git a/net-snmp.changes b/net-snmp.changes index fa7994b..9db080a 100644 --- a/net-snmp.changes +++ b/net-snmp.changes @@ -1,3 +1,23 @@ +------------------------------------------------------------------- +Thu Sep 3 09:48:31 UTC 2015 - meissner@suse.com + +- reenabled md5 and des, as some tools build against it and need + the methods :( + +------------------------------------------------------------------- +Thu Aug 13 20:24:01 UTC 2015 - abergmann@suse.com + +- added net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch: to fix + an incompletely initialized vulnerability within the + snmp_pdu_parse() function of snmp_api.c. + (bnc#940188, CVE-2015-5621) + +------------------------------------------------------------------- +Mon Aug 3 14:35:47 UTC 2015 - meissner@suse.com + +- Disable MD5 authentication method, disable DES support + (if something breaks, tell me) + ------------------------------------------------------------------- Wed Jul 22 07:19:05 UTC 2015 - jengelh@inai.de diff --git a/net-snmp.spec b/net-snmp.spec index 606b4d8..f2a8136 100644 --- a/net-snmp.spec +++ b/net-snmp.spec @@ -72,6 +72,7 @@ Patch6: net-snmp-5.7.3-velocity-mib.patch Patch7: net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch Patch8: net-snmp-5.7.3-netgroups.patch Patch9: net-snmp-5.7.3-snmpstatus-suppress-output.patch +Patch10: net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch # Summary: SNMP Daemon License: BSD-3-Clause and MIT @@ -206,6 +207,7 @@ Net-SNMP toolkit library. %patch7 -p1 %patch8 -p1 %patch9 -p1 +%patch10 -p1 %build MIBS="misc/ipfwacc ucd-snmp/diskio etherlike-mib rmon-mib velocity smux \