mirror of
https://gitlab.alpinelinux.org/alpine/aports.git
synced 2026-05-08 13:56:40 +02:00
main/net-snmp: mitigate cves
This commit is contained in:
psykose
parent
13c6c3d6c5
commit
edec5f4b11
@ -2,7 +2,7 @@
|
||||
# Maintainer: Carlo Landmeter <clandmeter@alpinelinux.org>
|
||||
pkgname=net-snmp
|
||||
pkgver=5.9.3
|
||||
pkgrel=0
|
||||
pkgrel=1
|
||||
pkgdesc="Simple Network Management Protocol"
|
||||
url="http://www.net-snmp.org/"
|
||||
arch="all"
|
||||
@ -16,6 +16,7 @@ subpackages="$pkgname-dbg $pkgname-doc $pkgname-dev $pkgname-libs $pkgname-agent
|
||||
source="https://downloads.sourceforge.net/net-snmp/net-snmp-$pkgver.tar.gz
|
||||
netsnmp-swinst-crash.patch
|
||||
fix-includes.patch
|
||||
CVE-2022-44792-44793.patch
|
||||
|
||||
snmpd.initd
|
||||
snmpd.confd
|
||||
@ -23,6 +24,10 @@ source="https://downloads.sourceforge.net/net-snmp/net-snmp-$pkgver.tar.gz
|
||||
"
|
||||
|
||||
# secfixes:
|
||||
# 5.9.3-r1:
|
||||
# - CVE-2015-8100
|
||||
# - CVE-2022-44792
|
||||
# - CVE-2022-44793
|
||||
# 5.9.3-r0:
|
||||
# - CVE-2022-24805
|
||||
# - CVE-2022-24806
|
||||
@ -42,9 +47,6 @@ prepare() {
|
||||
build() {
|
||||
export lt_cv_sys_max_cmd_len=8192
|
||||
|
||||
#build fails on: libnetsnmpmibs.so: undefined reference to 'pthread_create'
|
||||
LDFLAGS="$LDFLAGS -lpthread"
|
||||
|
||||
./configure \
|
||||
--build=$CBUILD \
|
||||
--host=$CHOST \
|
||||
@ -68,7 +70,7 @@ build() {
|
||||
--disable-embedded-perl
|
||||
# embedded-perl seems to create TEXTREL's
|
||||
|
||||
make -j1
|
||||
make
|
||||
}
|
||||
|
||||
package() {
|
||||
@ -87,7 +89,7 @@ package() {
|
||||
install -m644 -D "$srcdir"/snmpd.confd "$pkgdir"/etc/conf.d/snmpd
|
||||
install -m644 -D "$srcdir"/snmptrapd.confd \
|
||||
"$pkgdir"/etc/conf.d/snmptrapd
|
||||
install -m644 -D EXAMPLE.conf "$pkgdir"/etc/snmp/snmpd.conf
|
||||
install -m640 -D EXAMPLE.conf "$pkgdir"/etc/snmp/snmpd.conf
|
||||
echo "authCommunity log,execute,net public" > "$pkgdir"/etc/snmp/snmptrapd.conf
|
||||
mkdir -p "$pkgdir"/var/lib/net-snmp
|
||||
find "$pkgdir" -name perllocal.pod -delete
|
||||
@ -149,6 +151,7 @@ sha512sums="
|
||||
a476df4967029a2eb03d27b0e250170785d0a8c143d49b900ee958c3cbdfaccd415b70af40f6fbed9cb8819d522c35a6073a431091d908ccc7c018fa0aaa2abc net-snmp-5.9.3.tar.gz
|
||||
4ad92f50b14d5e27ba86256cc532a2dd055502f4d5fbb1700434f9f01f881fd09bb1eadb94e727554e1470f036707558314c64a66d0376b54e71ab31d5e4baa3 netsnmp-swinst-crash.patch
|
||||
87a552bd2e41684bba6e87fbcf6454a85ee912d7a339411fda24cebddf7661f0856729e076a917920a542cf84b687ffd90a091daa15f2c48f0ff64f3a53c0ddb fix-includes.patch
|
||||
db26a013554b389c60e1a9dc528e69f9d2d3a26a56cc2fda63c34ed3ec7df6c3dd4b921eb727d7592f82b2045b78f452988b5834f378eef4505c58c23f3e8d0f CVE-2022-44792-44793.patch
|
||||
1616d471105fc004bd7472d244d4ff9eae936875853bc51381ce2ddbb4bc29825beab6ed01299c76e3230b5725083ae169381f4572d12f015f6c682926b708bc snmpd.initd
|
||||
ca4921190e8b81e3244465fa66bf6f0a075add159c8ec13a1198ded155df89eb984a48e34972b20f549fbfa9bbff4a24d66bf7cd0b51f5f86a26ad4c2f5cf5cc snmpd.confd
|
||||
073fd2b83eedd6eda1f7345350268ce7946ef6d67a8f26f7c232e46feb75babf68272ae12071a2f9ea76ede71393b3ae4672d3cd47cfd14ab77e3a6482f2e124 snmptrapd.confd
|
||||
|
||||
130
main/net-snmp/CVE-2022-44792-44793.patch
Normal file
130
main/net-snmp/CVE-2022-44792-44793.patch
Normal file
@ -0,0 +1,130 @@
|
||||
Patch-Source: https://github.com/net-snmp/net-snmp/commit/be804106fd0771a7d05236cff36e199af077af57
|
||||
--
|
||||
From 4589352dac3ae111c7621298cf231742209efd9b Mon Sep 17 00:00:00 2001
|
||||
From: Bill Fenner <fenner@gmail.com>
|
||||
Date: Fri, 25 Nov 2022 08:41:24 -0800
|
||||
Subject: [PATCH 1/3] snmp_agent: disallow SET with NULL varbind
|
||||
|
||||
---
|
||||
agent/snmp_agent.c | 32 ++++++++++++++++++++++++++++++++
|
||||
1 file changed, 32 insertions(+)
|
||||
|
||||
diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
|
||||
index 867d0c166f..3f678fe2df 100644
|
||||
--- a/agent/snmp_agent.c
|
||||
+++ b/agent/snmp_agent.c
|
||||
@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status)
|
||||
return 1;
|
||||
}
|
||||
|
||||
+static int
|
||||
+check_set_pdu_for_null_varbind(netsnmp_agent_session *asp)
|
||||
+{
|
||||
+ int i;
|
||||
+ netsnmp_variable_list *v = NULL;
|
||||
+
|
||||
+ for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) {
|
||||
+ if (v->type == ASN_NULL) {
|
||||
+ /*
|
||||
+ * Protect SET implementations that do not protect themselves
|
||||
+ * against wrong type.
|
||||
+ */
|
||||
+ DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i));
|
||||
+ asp->index = i;
|
||||
+ return SNMP_ERR_WRONGTYPE;
|
||||
+ }
|
||||
+ }
|
||||
+ return SNMP_ERR_NOERROR;
|
||||
+}
|
||||
+
|
||||
int
|
||||
handle_pdu(netsnmp_agent_session *asp)
|
||||
{
|
||||
int status, inclusives = 0;
|
||||
netsnmp_variable_list *v = NULL;
|
||||
|
||||
+#ifndef NETSNMP_NO_WRITE_SUPPORT
|
||||
+ /*
|
||||
+ * Check for ASN_NULL in SET request
|
||||
+ */
|
||||
+ if (asp->pdu->command == SNMP_MSG_SET) {
|
||||
+ status = check_set_pdu_for_null_varbind(asp);
|
||||
+ if (status != SNMP_ERR_NOERROR) {
|
||||
+ return status;
|
||||
+ }
|
||||
+ }
|
||||
+#endif /* NETSNMP_NO_WRITE_SUPPORT */
|
||||
+
|
||||
/*
|
||||
* for illegal requests, mark all nodes as ASN_NULL
|
||||
*/
|
||||
|
||||
From 7f4ac4051cc7fec6a5944661923acb95cec359c7 Mon Sep 17 00:00:00 2001
|
||||
From: Bill Fenner <fenner@gmail.com>
|
||||
Date: Fri, 25 Nov 2022 08:41:46 -0800
|
||||
Subject: [PATCH 2/3] apps: snmpset: allow SET with NULL varbind for testing
|
||||
|
||||
---
|
||||
apps/snmpset.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/apps/snmpset.c b/apps/snmpset.c
|
||||
index 48e14bd513..d542713e1b 100644
|
||||
--- a/apps/snmpset.c
|
||||
+++ b/apps/snmpset.c
|
||||
@@ -182,6 +182,7 @@ main(int argc, char *argv[])
|
||||
case 'x':
|
||||
case 'd':
|
||||
case 'b':
|
||||
+ case 'n': /* undocumented */
|
||||
#ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES
|
||||
case 'I':
|
||||
case 'U':
|
||||
|
||||
From 15f9d7f7e5b90c9b419832ed8e6413feb6570d83 Mon Sep 17 00:00:00 2001
|
||||
From: Bill Fenner <fenner@gmail.com>
|
||||
Date: Fri, 25 Nov 2022 10:23:32 -0800
|
||||
Subject: [PATCH 3/3] Add test for NULL varbind set
|
||||
|
||||
---
|
||||
.../default/T0142snmpv2csetnull_simple | 31 +++++++++++++++++++
|
||||
1 file changed, 31 insertions(+)
|
||||
create mode 100644 testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||
|
||||
diff --git a/testing/fulltests/default/T0142snmpv2csetnull_simple b/testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||
new file mode 100644
|
||||
index 0000000000..0f1b8f386b
|
||||
--- /dev/null
|
||||
+++ b/testing/fulltests/default/T0142snmpv2csetnull_simple
|
||||
@@ -0,0 +1,31 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+. ../support/simple_eval_tools.sh
|
||||
+
|
||||
+HEADER SNMPv2c set of system.sysContact.0 with NULL varbind
|
||||
+
|
||||
+SKIPIF NETSNMP_DISABLE_SET_SUPPORT
|
||||
+SKIPIF NETSNMP_NO_WRITE_SUPPORT
|
||||
+SKIPIF NETSNMP_DISABLE_SNMPV2C
|
||||
+SKIPIFNOT USING_MIBII_SYSTEM_MIB_MODULE
|
||||
+
|
||||
+#
|
||||
+# Begin test
|
||||
+#
|
||||
+
|
||||
+# standard V2C configuration: testcomunnity
|
||||
+snmp_write_access='all'
|
||||
+. ./Sv2cconfig
|
||||
+STARTAGENT
|
||||
+
|
||||
+CAPTURE "snmpget -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0"
|
||||
+
|
||||
+CHECK ".1.3.6.1.2.1.1.4.0 = STRING:"
|
||||
+
|
||||
+CAPTURE "snmpset -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0 n x"
|
||||
+
|
||||
+CHECK "Reason: wrongType"
|
||||
+
|
||||
+STOPAGENT
|
||||
+
|
||||
+FINISHED
|
||||
Loading…
x
Reference in New Issue
Block a user