From: secure@conectiva.com.br
To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net,
bugtraq@securityfocus.com, security-alerts@linuxsecurity.com
Subject: [CLA-2002:462] Conectiva Linux Security Announcement - ucd-snmp
Date: Thu, 14 Feb 2002 11:45:16 -0200
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : ucd-snmp
SUMMARY : Multiple remote ucd-snmp vulnerabilities
DATE : 2002-02-14 11:43:00
ID : CLA-2002:462
RELEVANT
RELEASES : 5.0, prg graficos, ecommerce, 5.1, 6.0, 7.0
- -------------------------------------------------------------------------
DESCRIPTION
ucd-snmp is an implementation and a set of tools to deal with the
Simple Network Management Protocol (SNMP), which is responsible for
enabling remote administration and monitoring of network devices.
There are several vulnerabilities[1,2] in the ucd-snmp implementation
of SNMP which could lead to DoS attacks and even remote intrusion.
The Oulu University Secure Programming Group (OUSPG)[3] released a
study and a tool[4] with approximately 53000 tests for snmp error
condititions. Running this tests against ucd-snmp prior to version
4.2.3 caused several failures (like memory faults) which are possibly
remotely exploitable. ucd-snmp 4.2.3 (the version we are releasing in
this update) passed all the tests.
There's a good FAQ[5] and a complete advisory[6] available from the
CERTŪ Coordination Center about these vulnerabilities and about SNMP
in general.
SOLUTION
All ucd-snmp users should upgrade. Notice that the service snmpd and
the applications linked to the libraries provided by the package
should be restarted in order to use the new version.
REFERENCES:
1.http://www.securityfocus.com/bid/4088
2.http://www.securityfocus.com/bid/4089
3.http://www.ee.oulu.fi/research/ouspg
4.http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/
5.http://www.cert.org/tech_tips/snmp_faq.html
6.http://www.cert.org/advisories/CA-2002-03.html
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/ucd-snmp-4.2.3-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/ucd-snmp-devel-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/ucd-snmp-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/ucd-snmp-utils-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/ucd-snmp-4.2.3-U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/ucd-snmp-devel-4.2.3-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/ucd-snmp-utils-4.2.3-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/ucd-snmp-4.2.3-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/ucd-snmp-4.2.3-U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ucd-snmp-devel-4.2.3-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ucd-snmp-4.2.3-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/ucd-snmp-utils-4.2.3-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/ucd-snmp-4.2.3-U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ucd-snmp-4.2.3-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ucd-snmp-doc-4.2.3-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ucd-snmp-devel-static-4.2.3-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ucd-snmp-devel-4.2.3-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/ucd-snmp-utils-4.2.3-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/ucd-snmp-4.2.3-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/ucd-snmp-devel-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/ucd-snmp-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/ucd-snmp-utils-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/ucd-snmp-4.2.3-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/ucd-snmp-devel-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/ucd-snmp-4.2.3-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/ucd-snmp-utils-4.2.3-U50_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates
(replace 6.0 with the correct version number if you are not running CL6.0)
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE8a79r42jd0JmAcZARAoReAJsF91hE2IynnotMp6jxvhbBaVed0wCeP9Cz
VIAE0Wq1RcStScE1EKwtvDU=
=oJZU
-----END PGP SIGNATURE-----