Net-SNMP Security Releases: 5.4.2.1, 5.3.2.3 and 5.2.5.1

There has been a recent bug discovered in the Net-SNMP agent code
which can let a user with access to any part of the agent crash it.
IE, if you have the "public" community turned on, support other
anonymous access or don't completely trust all your users then it is
important you grab one of the new releases:

   New Versions
   ------------
   5.4.2.1
   5.3.2.3
   5.2.5.1

As a personal plea from me: We've always worked to protect the Net-SNMP
code against malicious unauthorized packets.  The key there is
"unauthorized".  SNMP is a very powerful service to turn on, but with
power comes the potential for abuse.  You'll note that we do not provide
a default snmpd.conf file with a default community name turned on.  This
is for your protection.  However, some vendors and likely some users do
redistribute our code with something like a "public" community string
turned on (often restricted in what it can access at least).  However, I
still think this is not good practice.  Providing *any* information
about your system to just anyone is a dangerous thing.  Sure, it's more
convenient to have an agent at least respond minimally to managers that
are trying to do network discovery.  But remember: if management
stations can easily discover information about your host, so can
everyone else.


Let me upgrade NOW!  Where's the code?
----------------------------------------
Grab one of the new releases from our sourceforge download sites:

  http://www.net-snmp.org/download.html



Are there vulnerability tracking numbers?
----------------------------------------
Yes (but I don't know the status of the listing):

  CVE:   CVE-2008-4309


Are there other work-arounds?
----------------------------------------
Putting the following configuration tokens in your snmpd.conf file
will help reduce the likelyhood of a malicious packet, but you'd still
be better off upgrading:

  maxGetbulkRepeats 1000


-- 
"In the bathtub of history the truth is harder to hold than the soap,
 and much more difficult to find."  -- Terry Pratchett

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/