-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3031
          Insufficient message length validation in bsnmp library
                               9 August 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           bsnmp
Publisher:         FreeBSD
Operating System:  FreeBSD
Impact/Access:     Denial of Service        -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-5610  

Original Bulletin: 
   https://security.freebsd.org/advisories/FreeBSD-SA-19:20.bsnmp.asc

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-19:20.bsnmp                                      Security Advisory
                                                          The FreeBSD Project

Topic:          Insufficient message length validation in bsnmp library

Category:       contrib
Module:         bsnmp
Announced:      2019-08-06
Credits:        Guido Vranken <guidovranken@gmail.com>
Affects:        All supported versions of FreeBSD.
Corrected:      2019-08-06 16:11:16 UTC (stable/12, 12.0-STABLE)
                2019-08-06 17:12:17 UTC (releng/12.0, 12.0-RELEASE-p9)
                2019-08-06 16:12:43 UTC (stable/11, 11.3-STABLE)
                2019-08-06 17:12:17 UTC (releng/11.3, 11.3-RELEASE-p2)
                2019-08-06 17:12:17 UTC (releng/11.2, 11.2-RELEASE-p13)
CVE Name:       CVE-2019-5610

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

The bsnmp software library is used for the Internet SNMP (Simple Network
Management Protocol).  As part of this it includes functions to handle ASN.1
(Abstract Syntax Notation One).

II.  Problem Description

A function extracting the length from type-length-value encoding is not
properly validating the submitted length.

III. Impact

A remote user could cause, for example, an out-of-bounds read, decoding of
unrelated data, or trigger a crash of the software such as bsnmpd resulting
in a denial of service.

IV.  Workaround

No workaround is available.

V.   Solution

Perform one of the following:

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-19:20/bsnmp.patch
# fetch https://security.FreeBSD.org/patches/SA-19:20/bsnmp.patch.asc
# gpg --verify bsnmp.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart all daemons that use the library, or reboot the system.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- - -------------------------------------------------------------------------
stable/12/                                                        r350637
releng/12.0/                                                      r350646
stable/11/                                                        r350638
releng/11.3/                                                      r350646
releng/11.2/                                                      r350646
- - -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:

<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

VII. References

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5610>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-19:20.bsnmp.asc>
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl1Jt1lfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKtBBAAltxFzxuMqWCgJoL9SemLRQxGGk0hRFdN5b78mgVdk2lfDgVz8U7mVM6v
XbcCa4lIy7wMYpUdEySAZLR2ENt0xdpx7oQ6lAg5fnnvrUvom4wU9ruxEs5txFVL
K6RaJnQJyOkI2c/LYvI/ZYmuc29/Nt3p/DvVe7wq86taoqUufN11MXkrRHgn68N3
7vewixzWpqH5L/aY2qP1d+Xe3QmHX0IcFqeo4U3/3G4wUGRCfHtaENY4w5eUbCa2
1Qk0oS9iUdX1IJjM5l1ccoFqsjbcO6vNS337qeYNKhLspXMQPwoS0K0HfB6LKt1D
dCBFoXu/qUFjf3qqbpcqGEFrFPZjlNmC4R0Ngx1rfZ1t1dXbj83NOOE1okd3Gb/V
TPDU/jzwt+/6DE6ryNQpeanPdim83w/j+qeA0UaTyxlbj+oSz1gU9Ckaauf+9peI
GT8TPnrgmFlYg2tkYl4tbq5LtRstPGZYguqEt5SHCxBOg3dxByMPzikSFUL9oNxS
9GX7JZT36J20f62hG8Watp2y3W0QsMjJpxF9OojRU6B15Z4Q2aCht4F6DnvEkVfN
1GvS5NAHPHU09TniSgYK3ThkoYrLYykhsXPmJmETV7DU1Qhny1p8H0NwIwB20DEm
AOAcYzLhiXHGpniE5y+MT9Pvt3BDBt36k6WgZ4eZ4RWuzGOumiU=
=rH6X
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXUzveGaOgq3Tt24GAQhsBA//fGbXTw4vjIxFKN5CzoJJIC9WSToXDwfj
Ob6/mxXHAe1JdweX2qBRPiqbVZFusoXd4d74tnwdbR5Brqk//p6NHo0d6nUhf8L9
8AmilwY2rGFUytJs3I2pRs1hf+j9rj/yRGpYvnRIzrZxBH+wmizuJRQ3tT+Fy9xJ
JgcAucWbkIMC6u6uO2MMJhbWN5AfgWf6La0PNxtwsMS1KLZNAh8LWTy9TaJQ8eGt
lpBQilAabiySpotKum8EmLmgrVJ2X5DeWWPNKuGEDxtxwHI8BtfeMPmWv8D1vT8N
pvkAecHqaxVq5qvs/WoMGgwtDuYRJct986a28rRcdX45Zu793J5qus92uwTFNnL0
NRjpjysVfX32zoPm0NXzMIjkpvJbY1boSu5s93nC0eZnpF6+aqe/jEAC9Ye10NVR
hQk6DNr7WMzh/WFXsfFDU1xxy8Pk/qs54Tkk5keHvSguuaU05yVFohEEkMiArNdk
Bm93eS6BHZHNyoh6524xS9l5I4mbL15KsdhiYqq+HljIaBlAFedqN7GWMfPZXdyo
KDIupa543lP/AdK6v9w7lD03EcD55rHFRdZM3thtbEHpHduSSAWZXi02RCvWZVx4
Vub7EKIuxYDpCI6MQNGoWOPtemOA4zpPgBJUN1+R7fGuhJuepmetOjc3phsuO3nX
/dT0m+F7ERk=
=NLxE
-----END PGP SIGNATURE-----