REDHAT-BUG-469349: Buffer Overflow
Oscar Mira-Sanchez reported (via TippingPoint/ZDI) to Net-SNMP upstream an integer overflow in the numresponses calculation in snmpagent.c. Size of memory requirement for bulkcache array is calculated based on the values form an SNMP request without properly checking for integer overflows, resulting in an insufficient memory allocation and heap-based buffer overflow.
agent/snmpagent.c:
numresponses = asp->pdu->errindex r;
[ ... ]
asp->bulkcache = (netsnmpvariablelist ) malloc(numresponses sizeof(struct varbindlist ));
Issue can be triggered by an SNMP get request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-469349?
The severity of REDHAT-BUG-469349 is categorized as critical due to the potential for integer overflow leading to memory corruption.
How do I fix REDHAT-BUG-469349?
To fix REDHAT-BUG-469349, update your Net-SNMP installation to the latest patched version provided by your distribution.
What impact does REDHAT-BUG-469349 have on vulnerable systems?
Systems affected by REDHAT-BUG-469349 may experience crashes or could be susceptible to remote code execution due to the integer overflow.
Which versions of software are affected by REDHAT-BUG-469349?
REDHAT-BUG-469349 affects certain versions of Net-SNMP prior to the release of patches addressing this vulnerability.
Is there a workaround for REDHAT-BUG-469349?
As a temporary workaround for REDHAT-BUG-469349, you can disable SNMP agent functionality until the patch is applied.