Browse code
net-snmp : Apply patch for CVE-2018-1000116
Change-Id: I73d8e378547f1155d0286ccf2792d8e556008513
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5008
Tested-by: michellew <michellew@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Xiaolin Li authored on 2018/04/17 06:35:26Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,121 @@ |
| 0 |
+--- a/snmplib/snmp_api.c |
|
| 1 |
+@@ -4350,10 +4350,9 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length) |
|
| 2 |
+ u_char type; |
|
| 3 |
+ u_char msg_type; |
|
| 4 |
+ u_char *var_val; |
|
| 5 |
+- int badtype = 0; |
|
| 6 |
+ size_t len; |
|
| 7 |
+ size_t four; |
|
| 8 |
+- netsnmp_variable_list *vp = NULL; |
|
| 9 |
++ netsnmp_variable_list *vp = NULL, *vplast = NULL; |
|
| 10 |
+ oid objid[MAX_OID_LEN]; |
|
| 11 |
+ u_char *p; |
|
| 12 |
+ |
|
| 13 |
+@@ -4493,40 +4681,26 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length) |
|
| 14 |
+ (ASN_SEQUENCE | ASN_CONSTRUCTOR), |
|
| 15 |
+ "varbinds"); |
|
| 16 |
+ if (data == NULL) |
|
| 17 |
+- return -1; |
|
| 18 |
++ goto fail; |
|
| 19 |
+ |
|
| 20 |
+ /* |
|
| 21 |
+ * get each varBind sequence |
|
| 22 |
+ */ |
|
| 23 |
+ while ((int) *length > 0) {
|
|
| 24 |
+- netsnmp_variable_list *vptemp; |
|
| 25 |
+- vptemp = (netsnmp_variable_list *) malloc(sizeof(*vptemp)); |
|
| 26 |
+- if (NULL == vptemp) {
|
|
| 27 |
+- return -1; |
|
| 28 |
+- } |
|
| 29 |
+- if (NULL == vp) {
|
|
| 30 |
+- pdu->variables = vptemp; |
|
| 31 |
+- } else {
|
|
| 32 |
+- vp->next_variable = vptemp; |
|
| 33 |
+- } |
|
| 34 |
+- vp = vptemp; |
|
| 35 |
++ vp = SNMP_MALLOC_TYPEDEF(netsnmp_variable_list); |
|
| 36 |
++ if (NULL == vp) |
|
| 37 |
++ goto fail; |
|
| 38 |
+ |
|
| 39 |
+- vp->next_variable = NULL; |
|
| 40 |
+- vp->val.string = NULL; |
|
| 41 |
+ vp->name_length = MAX_OID_LEN; |
|
| 42 |
+- vp->name = NULL; |
|
| 43 |
+- vp->index = 0; |
|
| 44 |
+- vp->data = NULL; |
|
| 45 |
+- vp->dataFreeHook = NULL; |
|
| 46 |
+ DEBUGDUMPSECTION("recv", "VarBind");
|
|
| 47 |
+ data = snmp_parse_var_op(data, objid, &vp->name_length, &vp->type, |
|
| 48 |
+ &vp->val_len, &var_val, length); |
|
| 49 |
+ if (data == NULL) |
|
| 50 |
+- return -1; |
|
| 51 |
++ goto fail; |
|
| 52 |
+ if (snmp_set_var_objid(vp, objid, vp->name_length)) |
|
| 53 |
+- return -1; |
|
| 54 |
++ goto fail; |
|
| 55 |
+ |
|
| 56 |
+ len = MAX_PACKET_LENGTH; |
|
| 57 |
+ DEBUGDUMPHEADER("recv", "Value");
|
|
| 58 |
+ switch ((short) vp->type) {
|
|
| 59 |
+ case ASN_INTEGER: |
|
| 60 |
+@@ -4533,7 +4533,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length) |
|
| 61 |
+ vp->val.string = (u_char *) malloc(vp->val_len); |
|
| 62 |
+ } |
|
| 63 |
+ if (vp->val.string == NULL) {
|
|
| 64 |
+- return -1; |
|
| 65 |
++ goto fail; |
|
| 66 |
+ } |
|
| 67 |
+ p = asn_parse_string(var_val, &len, &vp->type, vp->val.string, |
|
| 68 |
+ &vp->val_len); |
|
| 69 |
+@@ -4541,7 +4526,7 @@ |
|
| 70 |
+ vp->val_len *= sizeof(oid); |
|
| 71 |
+ vp->val.objid = (oid *) malloc(vp->val_len); |
|
| 72 |
+ if (vp->val.objid == NULL) {
|
|
| 73 |
+- return -1; |
|
| 74 |
++ goto fail; |
|
| 75 |
+ } |
|
| 76 |
+ memmove(vp->val.objid, objid, vp->val_len); |
|
| 77 |
+ break; |
|
| 78 |
+@@ -4631,21 +4631,37 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char * data, size_t * length) |
|
| 79 |
+ case ASN_BIT_STR: |
|
| 80 |
+ vp->val.bitstring = (u_char *) malloc(vp->val_len); |
|
| 81 |
+ if (vp->val.bitstring == NULL) {
|
|
| 82 |
+- return -1; |
|
| 83 |
++ goto fail; |
|
| 84 |
+ } |
|
| 85 |
+ p = asn_parse_bitstring(var_val, &len, &vp->type, |
|
| 86 |
+ vp->val.bitstring, &vp->val_len); |
|
| 87 |
+ if (!p) |
|
| 88 |
+- return -1; |
|
| 89 |
++ goto fail; |
|
| 90 |
+ break; |
|
| 91 |
+ default: |
|
| 92 |
+ snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type); |
|
| 93 |
+- badtype = -1; |
|
| 94 |
++ goto fail; |
|
| 95 |
+ break; |
|
| 96 |
+ } |
|
| 97 |
+ DEBUGINDENTADD(-4); |
|
| 98 |
++ |
|
| 99 |
++ if (NULL == vplast) {
|
|
| 100 |
++ pdu->variables = vp; |
|
| 101 |
++ } else {
|
|
| 102 |
++ vplast->next_variable = vp; |
|
| 103 |
++ } |
|
| 104 |
++ vplast = vp; |
|
| 105 |
++ vp = NULL; |
|
| 106 |
+ } |
|
| 107 |
+- return badtype; |
|
| 108 |
++ return 0; |
|
| 109 |
++ |
|
| 110 |
++ fail: |
|
| 111 |
++ DEBUGMSGTL(("recv", "error while parsing VarBindList\n"));
|
|
| 112 |
++ /** if we were parsing a var, remove it from the pdu and free it */ |
|
| 113 |
++ if (vp) |
|
| 114 |
++ snmp_free_var(vp); |
|
| 115 |
++ |
|
| 116 |
++ return -1; |
|
| 117 |
+ } |
|
| 118 |
+ |
|
| 119 |
+ /* |
| ... | ... |
@@ -1,22 +1,23 @@ |
| 1 | 1 |
%global __requires_exclude perl\\(.*\\) |
| 2 |
-Summary: Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. |
|
| 3 |
-Name: net-snmp |
|
| 4 |
-Version: 5.7.3 |
|
| 5 |
-Release: 7%{?dist}
|
|
| 6 |
-License: BSD (like) |
|
| 7 |
-URL: http://net-snmp.sourceforge.net/ |
|
| 8 |
-Group: Productivity/Networking/Other |
|
| 9 |
-Vendor: VMware, Inc. |
|
| 10 |
-Distribution: Photon |
|
| 11 |
-Source0: http://sourceforge.net/projects/%{name}/files/%{name}/%{version}/%{name}-%{version}.tar.gz
|
|
| 2 |
+Summary: Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. |
|
| 3 |
+Name: net-snmp |
|
| 4 |
+Version: 5.7.3 |
|
| 5 |
+Release: 8%{?dist}
|
|
| 6 |
+License: BSD (like) |
|
| 7 |
+URL: http://net-snmp.sourceforge.net/ |
|
| 8 |
+Group: Productivity/Networking/Other |
|
| 9 |
+Vendor: VMware, Inc. |
|
| 10 |
+Distribution: Photon |
|
| 11 |
+Source0: http://sourceforge.net/projects/%{name}/files/%{name}/%{version}/%{name}-%{version}.tar.gz
|
|
| 12 | 12 |
%define sha1 net-snmp=97dc25077257680815de44e34128d365c76bd839 |
| 13 |
-Source1: snmpd.service |
|
| 14 |
-Source2: snmptrapd.service |
|
| 15 |
-Patch1: net-snmp-5.7.2-systemd.patch |
|
| 13 |
+Source1: snmpd.service |
|
| 14 |
+Source2: snmptrapd.service |
|
| 15 |
+Patch1: net-snmp-5.7.2-systemd.patch |
|
| 16 | 16 |
Patch2: net-snmp-remove-u64-typedef.patch |
| 17 | 17 |
Patch3: net-snmp-fix-perl-module-compilation.patch |
| 18 |
-BuildRequires: openssl-devel perl systemd |
|
| 19 |
-Requires: perl systemd |
|
| 18 |
+Patch4: net-snmp-CVE-2018-1000116.patch |
|
| 19 |
+BuildRequires: openssl-devel perl systemd |
|
| 20 |
+Requires: perl systemd |
|
| 20 | 21 |
%description |
| 21 | 22 |
Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. |
| 22 | 23 |
|
| ... | ... |
@@ -33,22 +34,23 @@ The net-snmp-devel package contains headers and libraries for building SNMP appl |
| 33 | 33 |
%patch1 -p1 |
| 34 | 34 |
%patch2 -p1 |
| 35 | 35 |
%patch3 -p1 |
| 36 |
+%patch4 -p1 |
|
| 36 | 37 |
|
| 37 | 38 |
%build |
| 38 | 39 |
./configure --prefix=%{_prefix} \
|
| 39 |
- --host=ia64-linux \ |
|
| 40 |
- --build=i686 \ |
|
| 41 |
- --target=ia64-linux \ |
|
| 42 |
- --sbindir=/sbin \ |
|
| 43 |
- --with-sys-location="unknown" \ |
|
| 44 |
- --with-logfile=/var/log/net-snmpd.log \ |
|
| 45 |
- --with-persistent-directory=/var/lib/net-snmp \ |
|
| 46 |
- --with-sys-contact="root@localhost" \ |
|
| 47 |
- --with-defaults \ |
|
| 48 |
- --with-systemd \ |
|
| 49 |
- --disable-static \ |
|
| 50 |
- --with-x=no \ |
|
| 51 |
- --enable-as-needed |
|
| 40 |
+ --host=ia64-linux \ |
|
| 41 |
+ --build=i686 \ |
|
| 42 |
+ --target=ia64-linux \ |
|
| 43 |
+ --sbindir=/sbin \ |
|
| 44 |
+ --with-sys-location="unknown" \ |
|
| 45 |
+ --with-logfile=/var/log/net-snmpd.log \ |
|
| 46 |
+ --with-persistent-directory=/var/lib/net-snmp \ |
|
| 47 |
+ --with-sys-contact="root@localhost" \ |
|
| 48 |
+ --with-defaults \ |
|
| 49 |
+ --with-systemd \ |
|
| 50 |
+ --disable-static \ |
|
| 51 |
+ --with-x=no \ |
|
| 52 |
+ --enable-as-needed |
|
| 52 | 53 |
make |
| 53 | 54 |
|
| 54 | 55 |
%install |
| ... | ... |
@@ -96,17 +98,19 @@ rm -rf %{buildroot}/*
|
| 96 | 96 |
%exclude /usr/lib/perl5/5.22.1/x86_64-linux-thread-multi/perllocal.pod |
| 97 | 97 |
|
| 98 | 98 |
%changelog |
| 99 |
-* Mon Jul 24 2017 Dheeraj Shetty <dheerajs@vmware.com> 5.7.3-7 |
|
| 100 |
-- Make service file a different source |
|
| 101 |
-* Tue Apr 04 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 5.7.3-6 |
|
| 102 |
-- Patch to remove U64 typedef |
|
| 103 |
-* Mon Oct 04 2016 ChangLee <changLee@vmware.com> 5.7.3-5 |
|
| 104 |
-- Modified %check |
|
| 105 |
-* Thu May 26 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 5.7.3-4 |
|
| 106 |
-- Excluded the perllocal.pod log. |
|
| 107 |
-* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 5.7.3-3 |
|
| 108 |
-- GA - Bump release of all rpms |
|
| 109 |
-* Wed May 04 2016 Nick Shi <nshi@vmware.com> 5.7.3-2 |
|
| 110 |
-- Add snmpd and snmptrapd to systemd service. |
|
| 111 |
-* Mon Nov 30 2015 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 5.7.3-1 |
|
| 112 |
-- Initial build. First version |
|
| 99 |
+* Mon Apr 16 2018 Xiaolin Li <xiaolinl@vmware.com> 5.7.3-8 |
|
| 100 |
+- Apply patch for CVE-2018-1000116 |
|
| 101 |
+* Mon Jul 24 2017 Dheeraj Shetty <dheerajs@vmware.com> 5.7.3-7 |
|
| 102 |
+- Make service file a different source |
|
| 103 |
+* Tue Apr 04 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 5.7.3-6 |
|
| 104 |
+- Patch to remove U64 typedef |
|
| 105 |
+* Mon Oct 04 2016 ChangLee <changLee@vmware.com> 5.7.3-5 |
|
| 106 |
+- Modified %check |
|
| 107 |
+* Thu May 26 2016 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 5.7.3-4 |
|
| 108 |
+- Excluded the perllocal.pod log. |
|
| 109 |
+* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 5.7.3-3 |
|
| 110 |
+- GA - Bump release of all rpms |
|
| 111 |
+* Wed May 04 2016 Nick Shi <nshi@vmware.com> 5.7.3-2 |
|
| 112 |
+- Add snmpd and snmptrapd to systemd service. |
|
| 113 |
+* Mon Nov 30 2015 Harish Udaiya Kumar <hudaiyakumar@vmware.com> 5.7.3-1 |
|
| 114 |
+- Initial build. First version |