Accepting request 1056419 from home:abergmann:net-snmp-aes256-factory
- Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Use new MFD rewrites of mib modules, where available. - Disable legacy DES encryption and MD5 authentication protocols. OBS-URL: https://build.opensuse.org/request/show/1056419 OBS-URL: https://build.opensuse.org/package/show/network:utilities/net-snmp?expand=0&rev=57
This commit is contained in:
Git OBS Bridge
parent
772dbc2f88
commit
4d3e9392db
94
net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
Normal file
94
net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
Normal file
@ -0,0 +1,94 @@
|
|||||||
|
diff -Nurp net-snmp-5.9.3-orig/agent/snmp_agent.c net-snmp-5.9.3/agent/snmp_agent.c
|
||||||
|
--- net-snmp-5.9.3-orig/agent/snmp_agent.c 2022-07-13 23:14:14.000000000 +0200
|
||||||
|
+++ net-snmp-5.9.3/agent/snmp_agent.c 2023-01-05 12:44:03.533604744 +0100
|
||||||
|
@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_ses
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int
|
||||||
|
+check_set_pdu_for_null_varbind(netsnmp_agent_session *asp)
|
||||||
|
+{
|
||||||
|
+ int i;
|
||||||
|
+ netsnmp_variable_list *v = NULL;
|
||||||
|
+
|
||||||
|
+ for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) {
|
||||||
|
+ if (v->type == ASN_NULL) {
|
||||||
|
+ /*
|
||||||
|
+ * Protect SET implementations that do not protect themselves
|
||||||
|
+ * against wrong type.
|
||||||
|
+ */
|
||||||
|
+ DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i));
|
||||||
|
+ asp->index = i;
|
||||||
|
+ return SNMP_ERR_WRONGTYPE;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ return SNMP_ERR_NOERROR;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
int
|
||||||
|
handle_pdu(netsnmp_agent_session *asp)
|
||||||
|
{
|
||||||
|
int status, inclusives = 0;
|
||||||
|
netsnmp_variable_list *v = NULL;
|
||||||
|
|
||||||
|
+#ifndef NETSNMP_NO_WRITE_SUPPORT
|
||||||
|
+ /*
|
||||||
|
+ * Check for ASN_NULL in SET request
|
||||||
|
+ */
|
||||||
|
+ if (asp->pdu->command == SNMP_MSG_SET) {
|
||||||
|
+ status = check_set_pdu_for_null_varbind(asp);
|
||||||
|
+ if (status != SNMP_ERR_NOERROR) {
|
||||||
|
+ return status;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif /* NETSNMP_NO_WRITE_SUPPORT */
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* for illegal requests, mark all nodes as ASN_NULL
|
||||||
|
*/
|
||||||
|
diff -Nurp net-snmp-5.9.3-orig/apps/snmpset.c net-snmp-5.9.3/apps/snmpset.c
|
||||||
|
--- net-snmp-5.9.3-orig/apps/snmpset.c 2022-07-13 23:14:14.000000000 +0200
|
||||||
|
+++ net-snmp-5.9.3/apps/snmpset.c 2023-01-05 12:44:06.377533268 +0100
|
||||||
|
@@ -182,6 +182,7 @@ main(int argc, char *argv[])
|
||||||
|
case 'x':
|
||||||
|
case 'd':
|
||||||
|
case 'b':
|
||||||
|
+ case 'n': /* undocumented */
|
||||||
|
#ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES
|
||||||
|
case 'I':
|
||||||
|
case 'U':
|
||||||
|
diff -Nurp net-snmp-5.9.3-orig/testing/fulltests/default/T0142snmpv2csetnull_simple net-snmp-5.9.3/testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||||
|
--- net-snmp-5.9.3-orig/testing/fulltests/default/T0142snmpv2csetnull_simple 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ net-snmp-5.9.3/testing/fulltests/default/T0142snmpv2csetnull_simple 2023-01-05 12:44:08.701474860 +0100
|
||||||
|
@@ -0,0 +1,31 @@
|
||||||
|
+#!/bin/sh
|
||||||
|
+
|
||||||
|
+. ../support/simple_eval_tools.sh
|
||||||
|
+
|
||||||
|
+HEADER SNMPv2c set of system.sysContact.0 with NULL varbind
|
||||||
|
+
|
||||||
|
+SKIPIF NETSNMP_DISABLE_SET_SUPPORT
|
||||||
|
+SKIPIF NETSNMP_NO_WRITE_SUPPORT
|
||||||
|
+SKIPIF NETSNMP_DISABLE_SNMPV2C
|
||||||
|
+SKIPIFNOT USING_MIBII_SYSTEM_MIB_MODULE
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Begin test
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+# standard V2C configuration: testcomunnity
|
||||||
|
+snmp_write_access='all'
|
||||||
|
+. ./Sv2cconfig
|
||||||
|
+STARTAGENT
|
||||||
|
+
|
||||||
|
+CAPTURE "snmpget -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0"
|
||||||
|
+
|
||||||
|
+CHECK ".1.3.6.1.2.1.1.4.0 = STRING:"
|
||||||
|
+
|
||||||
|
+CAPTURE "snmpset -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0 n x"
|
||||||
|
+
|
||||||
|
+CHECK "Reason: wrongType"
|
||||||
|
+
|
||||||
|
+STOPAGENT
|
||||||
|
+
|
||||||
|
+FINISHED
|
||||||
@ -1,3 +1,14 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Jan 5 11:49:22 UTC 2023 - Alexander Bergmann <abergmann@suse.com>
|
||||||
|
|
||||||
|
- Fixed NULL pointer exception issue when handling ipDefaultTTL or
|
||||||
|
pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792).
|
||||||
|
add:
|
||||||
|
* net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
|
||||||
|
- Enable AES-192 and AES-256 privacy protocol (bsc#1206828).
|
||||||
|
- Use new MFD rewrites of mib modules, where available.
|
||||||
|
- Disable legacy DES encryption and MD5 authentication protocols.
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Oct 3 11:45:51 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>
|
Mon Oct 3 11:45:51 UTC 2022 - Andreas Stieger <andreas.stieger@gmx.de>
|
||||||
|
|
||||||
|
|||||||
@ -1,7 +1,7 @@
|
|||||||
#
|
#
|
||||||
# spec file for package net-snmp
|
# spec file for package net-snmp
|
||||||
#
|
#
|
||||||
# Copyright (c) 2022 SUSE LLC
|
# Copyright (c) 2023 SUSE LLC
|
||||||
#
|
#
|
||||||
# All modifications and additions to the file contributed by third parties
|
# All modifications and additions to the file contributed by third parties
|
||||||
# remain the property of their copyright owners, unless otherwise agreed
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
@ -65,6 +65,7 @@ Patch14: net-snmp-5.9.2-fix-create-v3-user-outfile.patch
|
|||||||
Patch15: net-snmp-5.9.1-subagent-set-response.patch
|
Patch15: net-snmp-5.9.1-subagent-set-response.patch
|
||||||
Patch16: net-snmp-5.9.3-fixed-python2-bindings.patch
|
Patch16: net-snmp-5.9.3-fixed-python2-bindings.patch
|
||||||
Patch17: net-snmp-5.9.3-grep.patch
|
Patch17: net-snmp-5.9.3-grep.patch
|
||||||
|
Patch18: net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
|
||||||
BuildRequires: %{python_module devel}
|
BuildRequires: %{python_module devel}
|
||||||
BuildRequires: %{python_module setuptools}
|
BuildRequires: %{python_module setuptools}
|
||||||
BuildRequires: autoconf
|
BuildRequires: autoconf
|
||||||
@ -256,14 +257,16 @@ autoreconf -fvi
|
|||||||
--with-sys-location="unknown" \
|
--with-sys-location="unknown" \
|
||||||
--with-mib-modules="$MIBS" \
|
--with-mib-modules="$MIBS" \
|
||||||
--with-cflags="%{optflags} -fcommon" \
|
--with-cflags="%{optflags} -fcommon" \
|
||||||
--with-ldflags="-Wl,-z,relro -Wl,-z,now" \
|
--with-ldflags="-Wl,-z,relro -Wl,-z,now" \
|
||||||
--with-persistent-directory="%{_localstatedir}/lib/net-snmp" \
|
--with-persistent-directory="%{_localstatedir}/lib/net-snmp" \
|
||||||
--with-agentx-socket="%{netsnmp_agentx_socket_dir_fhs}/master" \
|
--with-agentx-socket="%{netsnmp_agentx_socket_dir_fhs}/master" \
|
||||||
--with-temp-file-pattern=%{_localstatedir}/run/net-snmp/snmp-tmp-XXXXXX \
|
--with-temp-file-pattern=%{_localstatedir}/run/net-snmp/snmp-tmp-XXXXXX \
|
||||||
--with-logfile="%{netsnmp_logfile}" \
|
--with-logfile="%{netsnmp_logfile}" \
|
||||||
--with-libwrap="%{_prefix}" \
|
--with-libwrap="%{_prefix}" \
|
||||||
--with-perl-modules="INSTALLDIRS=vendor" \
|
--with-perl-modules="INSTALLDIRS=vendor" \
|
||||||
--with-defaults \
|
--with-defaults \
|
||||||
|
--with-pic \
|
||||||
|
--sysconfdir=%{_sysconfdir} \
|
||||||
--enable-shared \
|
--enable-shared \
|
||||||
--disable-static \
|
--disable-static \
|
||||||
--enable-as-needed \
|
--enable-as-needed \
|
||||||
@ -271,9 +274,14 @@ autoreconf -fvi
|
|||||||
--enable-local-smux \
|
--enable-local-smux \
|
||||||
--enable-ipv6 \
|
--enable-ipv6 \
|
||||||
--enable-ucd-snmp-compatibility \
|
--enable-ucd-snmp-compatibility \
|
||||||
|
--enable-mfd-rewrites \
|
||||||
--with-security-modules=tsm,usm \
|
--with-security-modules=tsm,usm \
|
||||||
--with-transports=TLSTCP,DTLSUDP \
|
--with-transports=TLSTCP,DTLSUDP \
|
||||||
--with-systemd
|
--with-systemd \
|
||||||
|
--with-openssl \
|
||||||
|
--enable-blumenthal-aes \
|
||||||
|
--disable-des \
|
||||||
|
--disable-md5
|
||||||
|
|
||||||
# Parallel build deps not properly stated
|
# Parallel build deps not properly stated
|
||||||
%make_build -j1
|
%make_build -j1
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user