RHBA-2008:0376 - Bug Fix Advisory

Topic

Updated net-snmp packages that fix various bugs are now available.

Description

The Simple Network Management Protocol (SNMP) is a protocol used for
network management. The net-snmp packages include various SNMP tools: an
extensible agent, an SNMP library, tools for requesting or setting
information from SNMP agents, tools for generating and handling SNMP traps,
a version of the netstat command which uses SNMP, and a Tk/Perl MIB browser.

A security flaw has been fixed so that the snmpd daemon no longer crashes
when receiving certain get requests (CVE-2007-5846)

In addition, these updated net-snmp packages provide fixes for the
following bugs:

• The snmpd daemon no longer crashes when reading process information from

the /proc filesystem.

• The snmpd daemon no longer enters an infinite loop when running with a

kernel without the IPv6 kernel module loaded.

• The snmpd daemon no longer crashes when receiving certain SMUX packets.
• The snmptrapd daemon nows passes the correct host name to trap handlers

and to syslog.

• All daemons now use the /var/run/snmp directory for temporary files,

which is more secure and does not produce SELinux alerts.

• The snmpd daemon correctly supports TCP for SNMP communication.
• the 'iquerysecname' and 'agentsecname' snmpd parameters are now read the

snmpd configuration file in the appropriate order.

• when the icmpStatsTable was queried by snmpwalk, the value of the

statistics were different from the values in /proc/net/snmp6.

• on rare occasions, the process counts for various processes would return

an incorrect number.

In addition, various Management Information Bases (MIBs) have been fixed
and updated.

• TCP-MIB has been fixed so that it includes all scalars in the tree walk.
• IP-MIB: a regression in icmpStatsTable has been fixed to conform to RFC 4293.
• IP-MIB: ipSystemStatsTable and ipAddressTable were enhanced to conform to

RFC 4293.

• IP-MIB: ipIfStatsTable and icmpMsgStatsTable were implemented.
• TCP-MIB: the RFC-defined tcpConnectionProcess table column has been added

to tcpConnectionTable.

• UDP-MIB: the RFC-defined udpEndpointProcess table columns has been added

to udpEndpointTable.

• HOST-RESOURCES-MIB: hrDeviceTable has been fixed so that it includes all

known OIDs in the tree walk.

• UCD-SNMP-MIB: dskTable now supports mount points containing spaces in

their paths.

This update also fixes syslog messages produced by snmp under the following
conditions:

• when an interface name exceeds 8 characters in length.
• when an interface does not have an IPv4 address but its alias does have

an IPv4 address.

• when the number of bytes read from or written to a physical disc

overflows 32 bits on certain systems.

• when an interface changes its name.
• when an interface changes its ifIndex.
• when an interface has multiple IPv6 addresses.

Users are advised to upgrade to these updated net-snmp packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 248342 - snmpwalk does not read TCP scalars
• BZ - 251332 - net-snmp-5.3.1-local-addr-v2.patch breaks TCP
• BZ - 270941 - snmptrapd passes traphandler incorrect hostname
• BZ - 338981 - net-snmp iquerysecname and agentsecname not read early enough in config
• BZ - 348681 - snmpwalk of UCD-SNMP-MIB dskEntry causes bad data if "disks" mount point contain spaces
• BZ - 357121 - snmpd filling /var/log/messages with errors
• BZ - 396141 - snmpd spams syslog with _access_interface_entry_save_name and _check_interface_entry_for_updates
• BZ - 401211 - snmptrapd when using traphandlers defaults to /tmp for temp files, breaks selinux rules
• BZ - 419511 - snmpwalk does not return value for all OIDs
• BZ - 433446 - ipv6ScopeZoneTable produces errors to log

CVEs

(none)

References

(none)