Re: CVE Request -- net-snmp (sensitive host information disclosure)

["Steven M. Christey" <coley () linus mitre org>]

I'm confused by the upstream diff being referenced by the Red Hat bug ID.
Specifically, it looks like some sprintf's got changed, and the result is
used for logging.  Is it certain that the attacker can bypass
authorization, or is net-snmp just mis-reporting it?

I'm going with authorization bypass at the moment.

======================================================
Name: CVE-2008-6123
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6123
Reference: MLIST:[oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
Reference: URL:http://www.openwall.com/lists/oss-security/2009/02/12/2
Reference: CNFIRM:http://bugs.gentoo.org/show_bug.cgi?id=250429
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=485211
Reference: CONFIRM:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
Reference: 
MISC:http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp
5.0.9 through 5.4.2, when using TCP wrappers for client authorization,
does not properly parse hosts.allow rules, which allows remote
attackers to bypass intended access restrictions and execute SNMP
queries, related to "source/destination IP address confusion."