Net-SNMP snmpnetstat client heap overflow
| netsnmp-snmpnetstat-heap-overflow (7776) |  High Risk |
Description:
The snmpnetstat tool in Net-SNMP is vulnerable to a heap overflow. By returning an invalid ifindex value to the snmpnetstat client when a list of interfaces is requested, a remote attacker can cause a heap overflow to occur, which could allow the execution of arbitrary code on the system with privileges of the snmpnetstat client.
Consequences:
Gain Access
Remedy:
Apply the patch for this vulnerability included in the BugTraq Mailing List posting dated Jan 3 2002 3:11PM. See References.
For Conectiva Linux:
Upgrade to the latest ucd-snmp package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:696 for more information. See References.
Conectiva Linux 7.0: 4.2.3-1U70_2cl or later
Conectiva Linux 8: 4.2.3-4U80_1cl or later
For Caldera OpenLinux Server and Workstation 3.1.1:
Upgrade to the latest version of ucd-snmp (4.2.1-18 or later), as listed in SCO Security Advisory CSSA-2003-029.0. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Thu Jan 03 2002 - 09:11:24 CST: Heap overflow in snmpnetstat.
- Conectiva Linux Security Announcement CLSA-2003:696: ucd-snmp.
- SCO Security Advisory CSSA-2003-029.0: OpenLinux: ucd-snmp remote heap overflow.
- The NET-SNMP Project Home Page: Welcome To The NET-SNMP Home Page.
- BID-3780: Net-SNMP snmpnetstat Remote Heap Overflow Vulnerability
- CVE-2002-1570: Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier, and net-snmp, allows remote attackers to execute arbitrary code via multiple getnextrequest PDU messages with conflicting ifindex variables, which cause snmpnetstat to write variable data past the end of an array.
Platforms Affected:
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Net-SNMP Net-SNMP 4.2.3
- SCO Caldera OpenLinux Server 3.1.1
- SCO Caldera OpenLinux Workstation 3.1.1
Reported:
Jan 03, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net