sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] net-snmp: fixproc insecure temporary file creation

From: Thomas Houssin <Thomas.Houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] net-snmp: fixproc insecure temporary file creation
Date: Sat, 04 Jun 2005 14:41:56 +0200

Synopsis
========
net-snmp creates temporary files in an insecure manner, possibly
allowing the execution of arbitrary code.

Background
==========
net-snmp provides tools and libraries relating to SNMP (the Simple
Network Management Protocol) including:
- An extensible agent
- An SNMP library
- tools to request or set information from SNMP agents
- tools to generate and handle SNMP traps, etc.

Description
===========
http://sourceforge.net/tracker/index.php?func=detail&aid=1203376&group_id=12694&atid=112694
The fixproc application of net-snmp creates temporary files with
predictable filenames.

Affected packages
=================
net-snmp in all grimoires is affected.
This is now fixed in devel, test, stable-rc and stable grimoire.

Resolution
==========
All net-snmp users should upgrade to the latest available version:
#scribe update
#cast -c net-snmp

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] net-snmp: fixproc insecure temporary file creation, Thomas Houssin, 06/04/2005