[INetCop Security Advisory] Snmppd potentially format string

[dong-hun you]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
INetCop Security Advisory #2005-0x82-027
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Title: Snmppd potentially format string vulnerability.


0x01. Description

About:
snmppd is an SNMP proxy daemon that is designed to work with Nagios.
It loads MIBs upon startup, listens on a TCP socket for SNMP GET requests,
polls the specified host, and returns the value to caller process.
The caller process is usually the Nagios plugin check_snmpp.=20

More detailed information is next URL.

URL: http://slava.local.nsys.by/projects/snmppd/

This could happen when program calls wrong syslog() function.
Using this vulnerability, attacker can get root access remotely.
But, for this code, it's only possiblity.=20
=20
The program uses wrong syslog() ,when option is matched.

`/snmppd-0.4.5/snmppd/snmppd_util.c':
--
...
23 void snmppd_log(int level, char *fmt, va_list args)
24 {
25 char buffer[2048];
26 vsnprintf(buffer, 2048, fmt, args);
27 if (config.debug || config.nofork) {
...
38 } else {
39 if (level >=3D LOG_INFO) {
40 syslog(level, buffer);
41 }
42 }
43 }
...
45 void log_error(char *fmt, ...)
46 {
...
50 snmppd_log(LOG_ERR, fmt, args);
...
52 }
53
54 void log_info(char *fmt, ...)
55 {
...
59 snmppd_log(LOG_INFO, fmt, args);
...
61 }
62
63 void log_debug(char *fmt, ...)
64 {
...
69 snmppd_log(LOG_DEBUG, fmt, args);
...
72 }
--

This code is used as displaied above.
INetcop Security team hasn't researched whether it is exploitable or not.


0x02. Vulnerable Packages


Vendor site: http://bubble.nsys.by/projects/snmppd/

snmppd all version
-snmppd-0.4.1.tar.gz
-snmppd-0.4.2.tar.gz
-snmppd-0.4.3-special.tar.gz
-snmppd-0.4.3.tar.gz
-snmppd-0.4.4.tar.gz
-snmppd-0.4.5.tar.gz
-snmppd-0.4.tar.gz
+Linux


0x03. Exploit


There is No exploit for now.


0x04. Patch


snmppd 0.4.5 patch:

=3D=3D=3D snmppd-0.4.5.patch =3D=3D=3D
--- snmppd_util.c Thu Jul 11 18:52:34 2002
+++ patch/snmppd_util.c Sat Mar 5 23:54:54 2005
@@ -37,7 +37,7 @@
fputc('\n', stdout);
} else {
if (level >=3D LOG_INFO) {
- syslog(level, buffer);
+ syslog(level, "%s", buffer);
}
}
}

=3D=3D=3D eof =3D=3D=3D


Japan MUST apologize what they have done to all Asian countries during WW2=
..=20
Eduation is to teach TRUE history to their child.

History is one thing that CAN NOT be changed.
Japan should follow German model.

Germany is also a defeated nation, but they feel deeply sorry for what
they have done and they teaches the REAL history.

The history goese on.


P.S: Sorry, for my poor english.


--
By "dong-houn yoU" (Xpl017Elz), in INetCop Security Co., LTD.

MSN & E-mail: szoahc(at)hotmail(dot)com,
xploit(at)hackermail(dot)com

INetCop Security Home: http://www.inetcop.net
My World: http://x82.inetcop.org

GPG public key: http://x82.inetcop.org/h0me/pr0file/x82.k3y
--


--=20
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze