Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=dc5f00cabfde7d493b9c7cb1fe8aeff05f90e761
commit dc5f00cabfde7d493b9c7cb1fe8aeff05f90e761 Author: kikadf <[email protected]> Date: Wed Apr 16 08:11:51 2014 +0200 net-snmp-5.7.1-4arcturus1-x86_64 * Fix CVE-2012-6151, CVE-2014-2284, CVE-2014-2285 diff --git a/source/network-extra/net-snmp/CVE-2012-6151.patch b/source/network-extra/net-snmp/CVE-2012-6151.patch new file mode 100644 index 0000000..c2f22ac --- /dev/null +++ b/source/network-extra/net-snmp/CVE-2012-6151.patch @@ -0,0 +1,302 @@ +Description: fix denial of service via AgentX subagent timeout +Origin: based on RedHat's backport of upstream commits. Thanks! +Origin: backport, http://sourceforge.net/p/net-snmp/code/ci/f9304c83f76202db0e684269ca1af32e43cd9db4 +Origin: backport, http://sourceforge.net/p/net-snmp/code/ci/793d596838ff7cb48a73b675d62897c56c9e62df +Bug: http://sourceforge.net/p/net-snmp/bugs/2411/ +Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731625 +Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6151 + +Index: net-snmp-5.7.2~dfsg/agent/mibgroup/agentx/master.c +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/mibgroup/agentx/master.c 2012-10-09 18:28:58.000000000 -0400 ++++ net-snmp-5.7.2~dfsg/agent/mibgroup/agentx/master.c 2014-03-11 09:16:01.212180291 -0400 +@@ -219,7 +219,10 @@ + if (!cache) { + DEBUGMSGTL(("agentx/master", "response too late on session %8p\n", + session)); +- return 0; ++ /* response is too late, free the cache */ ++ if (magic) ++ netsnmp_free_delegated_cache((netsnmp_delegated_cache*) magic); ++ return 1; + } + requests = cache->requests; + +@@ -606,6 +609,8 @@ + result = snmp_async_send(ax_session, pdu, agentx_got_response, cb_data); + if (result == 0) { + snmp_free_pdu(pdu); ++ if (cb_data) ++ netsnmp_free_delegated_cache((netsnmp_delegated_cache*) cb_data); + } + + return SNMP_ERR_NOERROR; +Index: net-snmp-5.7.2~dfsg/agent/mibgroup/agentx/master_admin.c +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/mibgroup/agentx/master_admin.c 2012-10-09 18:28:58.000000000 -0400 ++++ net-snmp-5.7.2~dfsg/agent/mibgroup/agentx/master_admin.c 2014-03-11 09:15:22.624179258 -0400 +@@ -133,11 +133,16 @@ + * requests, so that the delegated request will be completed and + * further requests can be processed + */ +- netsnmp_remove_delegated_requests_for_session(session); ++ while (netsnmp_remove_delegated_requests_for_session(session)) { ++ DEBUGMSGTL(("agentx/master", "Continue removing delegated reqests\n")); ++ } ++ + if (session->subsession != NULL) { + netsnmp_session *subsession = session->subsession; + for(; subsession; subsession = subsession->next) { +- netsnmp_remove_delegated_requests_for_session(subsession); ++ while (netsnmp_remove_delegated_requests_for_session(subsession)) { ++ DEBUGMSGTL(("agentx/master", "Continue removing delegated subsession reqests\n")); ++ } + } + } + +@@ -153,6 +158,7 @@ + for (sp = session->subsession; sp != NULL; sp = sp->next) { + + if (sp->sessid == sessid) { ++ netsnmp_remove_delegated_requests_for_session(sp); + unregister_mibs_by_session(sp); + unregister_index_by_session(sp); + unregister_sysORTable_by_session(sp); +Index: net-snmp-5.7.2~dfsg/agent/snmp_agent.c +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/snmp_agent.c 2012-10-09 18:28:58.000000000 -0400 ++++ net-snmp-5.7.2~dfsg/agent/snmp_agent.c 2014-03-11 09:17:09.304182115 -0400 +@@ -1446,6 +1446,7 @@ + netsnmp_free_cachemap(asp->cache_store); + asp->cache_store = NULL; + } ++ agent_snmp_session_release_cancelled(asp); + SNMP_FREE(asp); + } + +@@ -1457,6 +1458,10 @@ + + if (NULL == asp->treecache) + return 0; ++ ++ if (agent_snmp_session_is_cancelled(asp)) { ++ return 0; ++ } + + for (i = 0; i <= asp->treecache_num; i++) { + for (request = asp->treecache[i].requests_begin; request; +@@ -1535,39 +1540,48 @@ + netsnmp_remove_delegated_requests_for_session(netsnmp_session *sess) + { + netsnmp_agent_session *asp; +- int count = 0; ++ int total_count = 0; + + for (asp = agent_delegated_list; asp; asp = asp->next) { + /* + * check each request + */ ++ int i; ++ int count = 0; + netsnmp_request_info *request; +- for(request = asp->requests; request; request = request->next) { +- /* +- * check session +- */ +- netsnmp_assert(NULL!=request->subtree); +- if(request->subtree->session != sess) +- continue; ++ for (i = 0; i <= asp->treecache_num; i++) { ++ for (request = asp->treecache[i].requests_begin; request; ++ request = request->next) { ++ /* ++ * check session ++ */ ++ netsnmp_assert(NULL!=request->subtree); ++ if(request->subtree->session != sess) ++ continue; + +- /* +- * matched! mark request as done +- */ +- netsnmp_request_set_error(request, SNMP_ERR_GENERR); +- ++count; ++ /* ++ * matched! mark request as done ++ */ ++ netsnmp_request_set_error(request, SNMP_ERR_GENERR); ++ ++count; ++ } ++ } ++ if (count) { ++ agent_snmp_session_mark_cancelled(asp); ++ total_count += count; + } + } + + /* + * if we found any, that request may be finished now + */ +- if(count) { ++ if(total_count) { + DEBUGMSGTL(("snmp_agent", "removed %d delegated request(s) for session " +- "%8p\n", count, sess)); +- netsnmp_check_outstanding_agent_requests(); ++ "%8p\n", total_count, sess)); ++ netsnmp_check_delegated_requests(); + } + +- return count; ++ return total_count; + } + + int +@@ -2739,19 +2753,11 @@ + return final_status; + } + +-/* +- * loop through our sessions known delegated sessions and check to see +- * if they've completed yet. If there are no more delegated sessions, +- * check for and process any queued requests +- */ + void +-netsnmp_check_outstanding_agent_requests(void) ++netsnmp_check_delegated_requests(void) + { + netsnmp_agent_session *asp, *prev_asp = NULL, *next_asp = NULL; + +- /* +- * deal with delegated requests +- */ + for (asp = agent_delegated_list; asp; asp = next_asp) { + next_asp = asp->next; /* save in case we clean up asp */ + if (!netsnmp_check_for_delegated(asp)) { +@@ -2790,6 +2796,22 @@ + prev_asp = asp; + } + } ++} ++ ++/* ++ * loop through our sessions known delegated sessions and check to see ++ * if they've completed yet. If there are no more delegated sessions, ++ * check for and process any queued requests ++ */ ++void ++netsnmp_check_outstanding_agent_requests(void) ++{ ++ netsnmp_agent_session *asp; ++ ++ /* ++ * deal with delegated requests ++ */ ++ netsnmp_check_delegated_requests(); + + /* + * if we are processing a set and there are more delegated +@@ -2819,7 +2841,8 @@ + + netsnmp_processing_set = netsnmp_agent_queued_list; + DEBUGMSGTL(("snmp_agent", "SET request remains queued while " +- "delegated requests finish, asp = %8p\n", asp)); ++ "delegated requests finish, asp = %8p\n", ++ agent_delegated_list)); + break; + } + #endif /* NETSNMP_NO_WRITE_SUPPORT */ +@@ -2880,6 +2903,10 @@ + case SNMP_MSG_GETBULK: + case SNMP_MSG_GETNEXT: + netsnmp_check_all_requests_status(asp, 0); ++ if (agent_snmp_session_is_cancelled(asp)) { ++ DEBUGMSGTL(("snmp_agent","canceling next walk for asp %p\n", asp)); ++ break; ++ } + handle_getnext_loop(asp); + if (netsnmp_check_for_delegated(asp) && + netsnmp_check_transaction_id(asp->pdu->transid) != +@@ -3836,3 +3863,71 @@ + } + #endif /* NETSNMP_FEATURE_REMOVE_SET_ALL_REQUESTS_ERROR */ + /** @} */ ++ ++ ++/* ++ * Ugly hack to fix bug #950602 and preserve ABI ++ * (the official patch adds netsnmp_agent_session->flags). ++ * We must create parallel database of netsnmp_agent_sessions ++ * and put cancelled requests there instead of marking ++ * netsnmp_agent_session->flags. ++ */ ++static netsnmp_agent_session **cancelled_agent_snmp_sessions; ++static int cancelled_agent_snmp_sessions_count; ++static int cancelled_agent_snmp_sessions_max; ++ ++int ++agent_snmp_session_mark_cancelled(netsnmp_agent_session *session) ++{ ++ DEBUGMSGTL(("agent:cancelled", "Cancelling session %p\n", session)); ++ if (!session) ++ return 0; ++ if (cancelled_agent_snmp_sessions_count + 1 > cancelled_agent_snmp_sessions_max) { ++ netsnmp_agent_session **aux; ++ int max = cancelled_agent_snmp_sessions_max + 10; ++ aux = realloc(cancelled_agent_snmp_sessions, sizeof(netsnmp_agent_session*) * max); ++ if (!aux) ++ return SNMP_ERR_GENERR; ++ cancelled_agent_snmp_sessions = aux; ++ cancelled_agent_snmp_sessions_max = max; ++ } ++ cancelled_agent_snmp_sessions[cancelled_agent_snmp_sessions_count] = session; ++ cancelled_agent_snmp_sessions_count++; ++ return 0; ++} ++ ++int ++agent_snmp_session_is_cancelled(netsnmp_agent_session *session) ++{ ++ int i; ++ for (i=0; i<cancelled_agent_snmp_sessions_count; i++) ++ if (cancelled_agent_snmp_sessions[i] == session) { ++ DEBUGMSGTL(("agent:cancelled", "session %p is cancelled\n", session)); ++ return TRUE; ++ } ++ return FALSE; ++} ++ ++int ++agent_snmp_session_release_cancelled(netsnmp_agent_session *session) ++{ ++ int i, j; ++ ++ if (!session) ++ return 0; ++ ++ DEBUGMSGTL(("agent:cancelled", "Removing session %p\n", session)); ++ ++ /* delete the session from cancelled_agent_snmp_sessions */ ++ for (i=0, j=0; j<cancelled_agent_snmp_sessions_count; i++, j++) ++ if (cancelled_agent_snmp_sessions[j] == session) ++ i--; /* don't increase i in this loop iteration */ ++ else ++ cancelled_agent_snmp_sessions[i] = cancelled_agent_snmp_sessions[j]; ++ ++ cancelled_agent_snmp_sessions_count = i; ++ ++ for (; i< cancelled_agent_snmp_sessions_max; i++) ++ cancelled_agent_snmp_sessions[i] = NULL; ++ return 0; ++} +Index: net-snmp-5.7.2~dfsg/include/net-snmp/agent/snmp_agent.h +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/include/net-snmp/agent/snmp_agent.h 2012-10-09 18:28:58.000000000 -0400 ++++ net-snmp-5.7.2~dfsg/include/net-snmp/agent/snmp_agent.h 2014-03-11 09:15:22.628179258 -0400 +@@ -240,6 +240,7 @@ + int init_master_agent(void); + void shutdown_master_agent(void); + int agent_check_and_process(int block); ++ void netsnmp_check_delegated_requests(void); + void netsnmp_check_outstanding_agent_requests(void); + + int netsnmp_request_set_error(netsnmp_request_info *request, diff --git a/source/network-extra/net-snmp/CVE-2014-2284.patch b/source/network-extra/net-snmp/CVE-2014-2284.patch new file mode 100644 index 0000000..fb55a7a --- /dev/null +++ b/source/network-extra/net-snmp/CVE-2014-2284.patch @@ -0,0 +1,144 @@ +commit a1fd64716f6794c55c34d77e618210238a73bfa1 +Author: Wes Hardaker <[email protected]> +Date: Wed Feb 19 15:21:57 2014 -0800 + + bug fix from fenner: fix ICMP mib table handling on linux + +Index: net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/icmp.c +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/mibgroup/mibII/icmp.c 2014-03-11 09:17:48.404183162 -0400 ++++ net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/icmp.c 2014-03-11 09:17:48.396183162 -0400 +@@ -106,10 +106,20 @@ + int flags; + }; + ++#ifdef linux ++/* Linux keeps track of all possible message types */ ++#define ICMP_MSG_STATS_IPV4_COUNT 256 ++#else + #define ICMP_MSG_STATS_IPV4_COUNT 11 ++#endif + + #ifdef NETSNMP_ENABLE_IPV6 ++#ifdef linux ++/* Linux keeps track of all possible message types */ ++#define ICMP_MSG_STATS_IPV6_COUNT 256 ++#else + #define ICMP_MSG_STATS_IPV6_COUNT 14 ++#endif + #else + #define ICMP_MSG_STATS_IPV6_COUNT 0 + #endif /* NETSNMP_ENABLE_IPV6 */ +@@ -177,7 +187,7 @@ + inc = 0; + linux_read_icmp_msg_stat(&v4icmp, &v4icmpmsg, &flag); + if (flag) { +- while (254 != k) { ++ while (255 >= k) { + if (v4icmpmsg.vals[k].InType) { + icmp_msg_stats_table[i].ipVer = 1; + icmp_msg_stats_table[i].icmpMsgStatsType = k; +@@ -267,7 +277,7 @@ + inc = 0; + linux_read_icmp6_msg_stat(&v6icmp, &v6icmpmsg, &flag); + if (flag) { +- while (254 != k) { ++ while (255 >= k) { + if (v6icmpmsg.vals[k].InType) { + icmp_msg_stats_table[i].ipVer = 2; + icmp_msg_stats_table[i].icmpMsgStatsType = k; +@@ -1050,6 +1060,12 @@ + continue; + table_info = netsnmp_extract_table_info(request); + subid = table_info->colnum; ++ DEBUGMSGTL(( "mibII/icmpStatsTable", "oid: " )); ++ DEBUGMSGOID(( "mibII/icmpStatsTable", request->requestvb->name, ++ request->requestvb->name_length )); ++ DEBUGMSG(( "mibII/icmpStatsTable", " In %d InErr %d Out %d OutErr %d\n", ++ entry->icmpStatsInMsgs, entry->icmpStatsInErrors, ++ entry->icmpStatsOutMsgs, entry->icmpStatsOutErrors )); + + switch (subid) { + case ICMP_STAT_INMSG: +@@ -1117,6 +1133,11 @@ + continue; + table_info = netsnmp_extract_table_info(request); + subid = table_info->colnum; ++ DEBUGMSGTL(( "mibII/icmpMsgStatsTable", "oid: " )); ++ DEBUGMSGOID(( "mibII/icmpMsgStatsTable", request->requestvb->name, ++ request->requestvb->name_length )); ++ DEBUGMSG(( "mibII/icmpMsgStatsTable", " In %d Out %d Flags 0x%x\n", ++ entry->icmpMsgStatsInPkts, entry->icmpMsgStatsOutPkts, entry->flags )); + + switch (subid) { + case ICMP_MSG_STAT_IN_PKTS: +Index: net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/kernel_linux.c +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/mibgroup/mibII/kernel_linux.c 2014-03-11 09:17:48.404183162 -0400 ++++ net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/kernel_linux.c 2014-03-11 09:17:48.396183162 -0400 +@@ -81,9 +81,9 @@ + index = strtol(token, &delim, 0); + if (ERANGE == errno) { + continue; +- } else if (index > LONG_MAX) { ++ } else if (index > 255) { + continue; +- } else if (index < LONG_MIN) { ++ } else if (index < 0) { + continue; + } + if (NULL == (token = strtok_r(dataptr, " ", &saveptr1))) +@@ -94,9 +94,9 @@ + index = strtol(token, &delim, 0); + if (ERANGE == errno) { + continue; +- } else if (index > LONG_MAX) { ++ } else if (index > 255) { + continue; +- } else if (index < LONG_MIN) { ++ } else if (index < 0) { + continue; + } + if(NULL == (token = strtok_r(dataptr, " ", &saveptr1))) +@@ -426,14 +426,21 @@ + + vals = name; + if (NULL != icmp6msgstat) { ++ int type; + if (0 == strncmp(name, "Icmp6OutType", 12)) { + strsep(&vals, "e"); +- icmp6msgstat->vals[atoi(vals)].OutType = stats; ++ type = atoi(vals); ++ if ( type < 0 || type > 255 ) ++ continue; ++ icmp6msgstat->vals[type].OutType = stats; + *support = 1; + continue; + } else if (0 == strncmp(name, "Icmp6InType", 11)) { + strsep(&vals, "e"); +- icmp6msgstat->vals[atoi(vals)].InType = stats; ++ type = atoi(vals); ++ if ( type < 0 || type > 255 ) ++ continue; ++ icmp6msgstat->vals[type].InType = stats; + *support = 1; + continue; + } +Index: net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/kernel_linux.h +=================================================================== +--- net-snmp-5.7.2~dfsg.orig/agent/mibgroup/mibII/kernel_linux.h 2014-03-11 09:17:48.404183162 -0400 ++++ net-snmp-5.7.2~dfsg/agent/mibgroup/mibII/kernel_linux.h 2014-03-11 09:17:48.396183162 -0400 +@@ -121,11 +121,11 @@ + + /* Lets use wrapper structures for future expansion */ + struct icmp4_msg_mib { +- struct icmp_msg_mib vals[255]; ++ struct icmp_msg_mib vals[256]; + }; + + struct icmp6_msg_mib { +- struct icmp_msg_mib vals[255]; ++ struct icmp_msg_mib vals[256]; + }; + + struct udp_mib { diff --git a/source/network-extra/net-snmp/CVE-2014-2285.patch b/source/network-extra/net-snmp/CVE-2014-2285.patch new file mode 100644 index 0000000..c8ad821 --- /dev/null +++ b/source/network-extra/net-snmp/CVE-2014-2285.patch @@ -0,0 +1,34 @@ +commit 76e8d6d100320629d8a23be4b0128619600c919d +Author: Jan Safranek <[email protected]> +Date: Thu Mar 6 09:21:51 2014 +0100 + + CHANGES: snmpd: PATCH: 1275: from Viliam PúÄik: fixed Perl trap handler when processing trap with empty community string. + +diff --git a/perl/TrapReceiver/TrapReceiver.xs b/perl/TrapReceiver/TrapReceiver.xs +index e11ef27..8713efd 100644 +--- a/perl/TrapReceiver/TrapReceiver.xs ++++ b/perl/TrapReceiver/TrapReceiver.xs +@@ -81,18 +81,18 @@ int perl_trapd_handler( netsnmp_pdu *pdu, + STOREPDUi("securitymodel", pdu->securityModel); + STOREPDUi("securitylevel", pdu->securityLevel); + STOREPDU("contextName", +- newSVpv(pdu->contextName, pdu->contextNameLen)); ++ newSVpv(pdu->contextName ? pdu->contextName : "", pdu->contextNameLen)); + STOREPDU("contextEngineID", +- newSVpv((char *) pdu->contextEngineID, ++ newSVpv(pdu->contextEngineID ? (char *) pdu->contextEngineID : "", + pdu->contextEngineIDLen)); + STOREPDU("securityEngineID", +- newSVpv((char *) pdu->securityEngineID, ++ newSVpv(pdu->securityEngineID ? (char *) pdu->securityEngineID : "", + pdu->securityEngineIDLen)); + STOREPDU("securityName", +- newSVpv((char *) pdu->securityName, pdu->securityNameLen)); ++ newSVpv(pdu->securityName ? (char *) pdu->securityName : "", pdu->securityNameLen)); + } else { + STOREPDU("community", +- newSVpv((char *) pdu->community, pdu->community_len)); ++ newSVpv(pdu->community ? (char *) pdu->community : "", pdu->community_len)); + } + + if (transport && transport->f_fmtaddr) { diff --git a/source/network-extra/net-snmp/FrugalBuild b/source/network-extra/net-snmp/FrugalBuild index 460fb62..d2a47a2 100644 --- a/source/network-extra/net-snmp/FrugalBuild +++ b/source/network-extra/net-snmp/FrugalBuild @@ -4,7 +4,7 @@ pkgname=net-snmp pkgver=5.7.1 -pkgrel=3 +pkgrel=4arcturus1 pkgdesc="A suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6" depends=('openssl>=1.0.0' 'perl>=5.10.0') groups=('network-extra') @@ -18,6 +18,14 @@ sha1sums=('ddb82ce1112ef0642869d3c8d7c7e585f151849a' \ _F_systemd_units=(snmpd=) Finclude systemd +# FSA fix *** +source=(${source[@]} CVE-2012-6151.patch CVE-2014-2284.patch CVE-2014-2285.patch) +sha1sums=(${sha1sums[@]} '37553ae154796a4789e2d4be965b847f0bafbe94' \ + 'f63a26628a7b1a20fb1cabd4dc64b592c9966a04' \ + '15d41f13ae3263d5e67f2078a55fc3e47cbe657f') +signatures=(${signatures} '' '' '') +# *********** + build() { unset MAKEFLAGS export NETSNMP_DONT_CHECK_VERSION=1
_______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
