Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerability

Bugtraq ID:	33755
Class:	Access Validation Error
CVE:	CVE-2008-6123
Remote:	Yes
Local:	No
Published:	Feb 12 2009 12:00AM
Updated:	Jun 02 2010 08:50PM
Credit:	Marcel Meckel
Vulnerable:	Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SuSE SUSE Linux Enterprise 10 SP2 DEBUGINFO SuSE SUSE Linux Enterprise 10 SP1 DEBUGINFO SuSE SUSE Linux Enterprise 10 S.u.S.E. SUSE Linux Enterprise Server RT Solution 10 0 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux WS 5 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux 5 Server Redhat Directory Server 8 EL 5 Redhat Directory Server 8 EL 4 Redhat Desktop 3.0 Net-SNMP Net-SNMP 5.4.2 1 Net-SNMP Net-SNMP 5.4.1 .1 Net-SNMP Net-SNMP 5.4.1 Net-SNMP Net-SNMP 5.3.2 3 Net-SNMP Net-SNMP 5.3.2 .1 Net-SNMP Net-SNMP 5.3.2 Net-SNMP Net-SNMP 5.3 Net-SNMP Net-SNMP 5.2.5 1 Net-SNMP Net-SNMP 5.2.4 .1 Net-SNMP Net-SNMP 5.2.4 Net-SNMP Net-SNMP 5.2.2 Net-SNMP Net-SNMP 5.2.1 .2 Net-SNMP Net-SNMP 5.2.1 Net-SNMP Net-SNMP 5.2 Net-SNMP Net-SNMP 5.1.4 Net-SNMP Net-SNMP 5.1.3 Net-SNMP Net-SNMP 5.1.2 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 Net-SNMP Net-SNMP 5.1.1 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Net-SNMP Net-SNMP 5.1 Net-SNMP Net-SNMP 5.0.10 .2 Net-SNMP Net-SNMP 5.0.9 Net-SNMP Net-SNMP 5.0.8 Net-SNMP Net-SNMP 5.0.7 Net-SNMP Net-SNMP 5.0.6 Net-SNMP Net-SNMP 5.0.5 Net-SNMP Net-SNMP 5.0.4 .pre2 + Redhat Linux 9.0 i386 + Redhat Linux 8.0 i386 Net-SNMP Net-SNMP 5.0.3 Net-SNMP Net-SNMP 5.0.1 Net-SNMP Net-SNMP 5.3.0.1 Net-SNMP Net-SNMP 0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Gentoo Linux Avaya Aura Application Enablement Services 3.1.6 Avaya Aura Application Enablement Services 3.1.5 Avaya Aura Application Enablement Services 3.1.4 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 3.1 Avaya Aura Application Enablement Services 3.0
Not Vulnerable:

Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerability

Net-SNMP is prone to a remote information-disclosure vulnerability because it fails to properly handle TCP Wrapper authorization rules.

Exploiting this issue will allow attackers to obtain sensitive information that can help them further attacks.

Net-SNMP 5.4.2.1 is vulnerable; other versions are also likely affected.

Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerability

Attackers can exploit this issue with readily available tools.

Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu libsnmp-base_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-base_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb


• Ubuntu libsnmp-dev_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp-dev_5.4.2.1~dfsg0 ubuntu1-0ubuntu2.1_powerpc.deb


• Ubuntu libsnmp-perl_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp-perl_5.4.2.1~dfsg 0ubuntu1-0ubuntu2.1_powerpc.deb


• Ubuntu libsnmp-python_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/n/net-snmp/libsnmp-python_5.4.2. 1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb


• Ubuntu libsnmp15-dbg_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp15-dbg_5.4.2.1~dfs g0ubuntu1-0ubuntu2.1_powerpc.deb


• Ubuntu libsnmp15_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp15_5.4.2.1~dfsg0ub untu1-0ubuntu2.1_powerpc.deb


• Ubuntu snmp_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/snmp_5.4.2.1~dfsg0ubuntu1 -0ubuntu2.1_powerpc.deb


• Ubuntu snmpd_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/snmpd_5.4.2.1~dfsg0ubuntu 1-0ubuntu2.1_powerpc.deb


• Ubuntu tkmib_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/tkmib_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu libsnmp-base_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-base_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb


• Ubuntu libsnmp-dev_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-dev_5.4 .2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu libsnmp-perl_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-perl_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu libsnmp-python_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/libsnmp-pyt hon_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu libsnmp15-dbg_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp15-dbg_5 .4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu libsnmp15_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp15_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu snmp_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmp_5.4.2.1~df sg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu snmpd_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmpd_5.4.2.1~d fsg0ubuntu1-0ubuntu2.1_amd64.deb


• Ubuntu tkmib_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/tkmib_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64net-snmp-devel-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64net-snmp-static-devel-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64net-snmp15-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-mibs-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-tkmib-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-trapd-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-utils-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva perl-NetSNMP-5.4.2-2.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu libsnmp-base_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-base_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb


• Ubuntu libsnmp-dev_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-dev_5.4 .2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu libsnmp-perl_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-perl_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu libsnmp-python_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/libsnmp-pyt hon_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu libsnmp15-dbg_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp15-dbg_5 .4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu libsnmp15_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp15_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu snmp_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmp_5.4.2.1~df sg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu snmpd_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmpd_5.4.2.1~d fsg0ubuntu1-0ubuntu2.1_i386.deb


• Ubuntu tkmib_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/tkmib_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_all.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libnet-snmp-devel-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libnet-snmp-static-devel-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libnet-snmp15-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-mibs-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-tkmib-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-trapd-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva net-snmp-utils-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva perl-NetSNMP-5.4.2-2.2mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu libsnmp-base_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-base_5. 4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb


• Ubuntu libsnmp-dev_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp-dev_5.4.2.1~dfsg0 ubuntu1-0ubuntu2.1_sparc.deb


• Ubuntu libsnmp-perl_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp-perl_5.4.2.1~dfsg 0ubuntu1-0ubuntu2.1_sparc.deb


• Ubuntu libsnmp-python_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/n/net-snmp/libsnmp-python_5.4.2. 1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb


• Ubuntu libsnmp15-dbg_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp15-dbg_5.4.2.1~dfs g0ubuntu1-0ubuntu2.1_sparc.deb


• Ubuntu libsnmp15_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/libsnmp15_5.4.2.1~dfsg0ub untu1-0ubuntu2.1_sparc.deb


• Ubuntu snmp_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/snmp_5.4.2.1~dfsg0ubuntu1 -0ubuntu2.1_sparc.deb


• Ubuntu snmpd_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/net-snmp/snmpd_5.4.2.1~dfsg0ubuntu 1-0ubuntu2.1_sparc.deb


• Ubuntu tkmib_5.4.2.1~dfsg0ubuntu1-0ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/tkmib_5.4.2 .1~dfsg0ubuntu1-0ubuntu2.1_all.deb

Net-SNMP 'snmpUDPDomain.c' Remote Information Disclosure Vulnerability

References:

• Bugzilla Bug 250429 net-snmp / tcp-wrappers vulnerability allowing 3rd parties t (Marcel Meckel)
  
• Bugzilla Bug 485211 CVE-2008-6123 net-snmp: snmp queries allowed from each remot (Jan Lieskovsky)
  
• Fix src/dst confusion (dts12)
  
• Net-SNMP Homepage (Net-SNMP)
  
• ASA-2009-118 net-snmp security update (RHSA-2009-0295) (Avaya)