142 lines
5.4 KiB
Text
142 lines
5.4 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:06.bsnmpd Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Insecure default bsnmpd.conf permissions
|
|
|
|
Category: contrib
|
|
Module: bsnmpd
|
|
Announced: 2016-01-14
|
|
Credits: Pierre Kim
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2016-01-14 09:11:42 UTC (stable/10, 10.2-STABLE)
|
|
2016-01-14 09:10:46 UTC (releng/10.2, 10.2-RELEASE-p9)
|
|
2016-01-14 09:11:16 UTC (releng/10.1, 10.1-RELEASE-p26)
|
|
2016-01-14 09:11:48 UTC (stable/9, 9.3-STABLE)
|
|
2016-01-14 09:11:26 UTC (releng/9.3, 9.3-RELEASE-p33)
|
|
CVE Name: CVE-2015-5677
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The bsnmpd daemon serves the Internet SNMP (Simple Network Management
|
|
Protocol). It is intended to serve only the absolute basic MIBs and
|
|
implements all other MIBs through loadable modules.
|
|
|
|
II. Problem Description
|
|
|
|
The SNMP protocol supports an authentication model called USM, which relies
|
|
on a shared secret. The default permission of the bsnmpd configuration file,
|
|
/etc/bsnmpd.conf, is weak and does not provide adequate protection against
|
|
local unprivileged users.
|
|
|
|
III. Impact
|
|
|
|
A local user may be able to read the shared secret, if configured and used
|
|
by the system administrator.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems that do not use bsnmpd with its USM
|
|
authentication model are not vulnerable.
|
|
|
|
V. Solution
|
|
|
|
This vulnerability can be fixed by modifying the permission on
|
|
/etc/bsnmpd.conf to owner root:wheel and permission 0600.
|
|
|
|
The patch is provided mainly for third party vendors who deploy FreeBSD
|
|
and provide a safe default. The patch itself DOES NOT fix the permissions
|
|
for existing installations.
|
|
|
|
The patch can be applied by performing one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
The system administrator should change the permission on /etc/bsnmpd.conf
|
|
to root:wheel and 0600.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
The system administrator should change the permission on /etc/bsnmpd.conf
|
|
to root:wheel and 0600.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:06/bsnmpd.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:06/bsnmpd.patch.asc
|
|
# gpg --verify bsnmpd.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r293898
|
|
releng/9.3/ r293896
|
|
stable/10/ r293897
|
|
releng/10.1/ r293894
|
|
releng/10.2/ r293893
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5677>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:06.bsnmpd.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIcBAEBCgAGBQJWl2j4AAoJEO1n7NZdz2rnkaQP/3K9kqYY1YoHQ++uzFPnfuZQ
|
|
mkGPJ0frGG46pTL806QJidky6D0LP0zNCzhtU45ZlFMguJ3B3QYp/62Cw61dBG22
|
|
x0uEkvI2F2F39IPA/clspyUHg3Y1RYgTpJrxey0JLrK0yxelyI8vMwB4tCB2eEDW
|
|
ZGVU6rvFQcWJOWHABXVYcc+4Yy5ucudp0QbJsVHAKLtF7MLuntVlUj+x4Nncog5k
|
|
kmGt6W7tzFn2gNsWcmntmG/LWyPkPURWhYfIj3fgcRrpMTVIDFX5PTgQyJR7DwOM
|
|
/beIoQxxKBUwTW1ZRgvcCqFBu7DKSCMABoHgpqLj1gdeiJ1LaO4dErtWXvdBEAAP
|
|
+XLi5OkRG3OKzIAIRnkz/SrkAUoRkzHEK1dI0coyw7AdXXjDBWtX+n9lzRXs7hqT
|
|
LC3riK/Km9OYVn3+T7tCWnvKN45f+FnD8zxZDE+33Jv9wI8X+CCs9GjJdoJ0HDSd
|
|
b6rg8E4gGPzfwFxSNXZQKfDSSuVBECIp3av1gp6hN3qZNOX/sadMsxro8VVGFLPg
|
|
81rC+JfKNTeVtxF8oJi9eg3FQ/eupxQv4RvC2c37R7LcErAU1KKxZyNrwv6xDEMx
|
|
QVnx74o+luxXSirLxq276pfBQJdMjxYzWCj6E8ztcAZenz3M4WNiRFlt7hdq/3YO
|
|
bDBdQPe4eYSHHSGyGcz/
|
|
=LDPU
|
|
-----END PGP SIGNATURE-----
|