Hi, I intent to upload an NMU (this time with the correct patch :). For obvious reasons (see -private) I am going to upload this as a 0-day NMU.
debdiff attached and archived on: http://people.debian.org/~nion/nmu-diff/net-snmp-5.4.1~dfsg-8_5.4.1~dfsg-8.1.patch Cheers Nico -- Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
diff -u net-snmp-5.4.1~dfsg/debian/changelog net-snmp-5.4.1~dfsg/debian/changelog
--- net-snmp-5.4.1~dfsg/debian/changelog
+++ net-snmp-5.4.1~dfsg/debian/changelog
@@ -1,3 +1,13 @@
+net-snmp (5.4.1~dfsg-8.1) unstable; urgency=high
+
+ * Non-maintainer upload by the Security Team.
+ * This update fixes the following security issue:
+ - CVE-2008-0960: The authentication code relies on the client specified
+ HMAC length which makes it easier for an attacker to match a correct HMAC
+ and authentication if a single byte HMAC is supplied (Closes: #485945)
+
+ -- Nico Golde <[EMAIL PROTECTED]> Thu, 12 Jun 2008 22:22:52 +0200
+
net-snmp (5.4.1~dfsg-8) unstable; urgency=low
* NACK NMU as the patch broke perl (Closes: #483588)
only in patch2:
unchanged:
--- net-snmp-5.4.1~dfsg.orig/debian/patches/50_cve2008_0960.README
+++ net-snmp-5.4.1~dfsg/debian/patches/50_cve2008_0960.README
@@ -0,0 +1 @@
+Upstream Changeset 17023: BUG: 1989089: Check for HMAC length
only in patch2:
unchanged:
--- net-snmp-5.4.1~dfsg.orig/debian/patches/50_cve2008_0960.patch
+++ net-snmp-5.4.1~dfsg/debian/patches/50_cve2008_0960.patch
@@ -0,0 +1,13 @@
+--- net-snmp-5.4.1/snmplib/scapi.c 2006-09-15 05:47:01.000000000 -0700
++++ net-snmp-5.4.1.1/snmplib/scapi.c 2008-05-13 17:43:17.000000000 -0700
+@@ -563,6 +563,10 @@
+ }
+
+
++ if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
++ QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
++ }
++
+ /*
+ * Generate a full hash of the message, then compare
+ * the result with the given MAC which may shorter than
pgp7koeGvuM6h.pgp
Description: PGP signature
