|
Bugzilla – Full Text Bug Listing |
| Summary: | TCP Port 199 is exposed when SNMP agent is running | ||
|---|---|---|---|
| Product: | [openSUSE] SUSE LINUX 10.0 | Reporter: | Michael Slifcak <slif> |
| Component: | Network | Assignee: | Marcus Rückert <mrueckert> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | meissner |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | i686 | ||
| OS: | SLES 9 | ||
| Whiteboard: | |||
| Found By: | Third Party Developer/Partner | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
Does this happen with SuSE Linux 10.0? Please provide the version of the used SuSE Linux 10.0 ... which Beta, which RC? i have the suspicion this is a SLES 9 bugreport. is this correct? I don't have SuSE Linux 10.0 to test. The Bugzilla interface via http://bugzilla.novell.com has no product listing SLES9, but I did set the OS field to SLES9 choice when submitting the report. The description clearly states which SLES9 components were tested. what do you think about adding a sysconfig option to dis-/enable smux? excellent suggestion! [[[ $ tail -n 12 *sysconfig ## Path: System/Net-SNMP ## Description: En-/Disables SNMP SMUX support. ## Type: yesno ## Default: yes # # If this setting is set to "no" the snmpd will no longer bind # the TCP Port 199. # # The default is set to "yes" to provide backward compatibility. # SNMPD_USE_SMUX="yes" ]]] submitted to SP3 applied the same fix for 10.1/SLES10 |
Problem: TCP Port 199 is exposed when SNMP agent is running Impact: Low Risk: Low. There are no vulnerability advisories for SMUX port 199. Package Name: net-snmp-5.1-80.11 [SLES9 Service Pack 1 and Service Pack 2] Package Name: net-snmp-5.1-80.16 [SLES9 Service Pack 2] Not Tested : net-snmp-5.1-80.3 [SLES9 base] Description: The net-snmp software is built by default to support a deprecated agent protocol known as SMUX. When the SMUX module is activated, the net-snmp agent "snmpd" binds to TCP port 199. This can be seen using the command below : # netstat -pan | egrep "199|161" tcp 0 0 0.0.0.0:199 0.0.0.0:* LISTEN 24604/snmpd udp 0 0 0.0.0.0:161 0.0.0.0:* 24604/snmpd net-snmp agent can be invoked such that modules like SMUX can be not activated. From the command line: /usr/sbin/snmpd .... -I -smux The problem: on SuSE Linux Enterprise Server 9, both Service Pack 1 and Service Pack 2, specifying '-I -smux' when invoking the net-snmp agent "snmpd" does NOT prevent the SMUX module from activating. Test-By [CAUTION: You must use a privileged user session, eg., root]: 1. Check the status of snmpd. If it is running, stop the snmpd. # /etc/init.d/snmpd status # /etc/init.d/snmpd stop 2. Edit /etc/init.d/snmpd. Change the 'startproc' line by appending '-I -smux' to the end of the line. It should look something like this when you are finished editing: startproc $SNMPD -c $SNMPDCONF -r -A -Lf /var/log/net-snmpd.log -p /var/run/snmpd.pid $agentargs -I -smux 3. Start the snmpd # /etc/init.d/snmpd start 4. Verify no program binds to port 199 (smux): # netstat -pan | egrep "199|161" Submitter: Mike Slifcak, Net-SNMP admin/developer Contact: Mike Slifcak Trusted Network Technologies, Inc. 3600 Mansell Road, Suite 200 Alpharetta, Georgia 30022 +1.678.990.5430 mslifcak@trustednetworktech.com