The CVE you mentioned is a configuration issue (when using the SampleAgent defaults). Nothing else. The implemented “fixes” make it easier to do a secure configuration.
Thus, on the existing systems:
- If the MIB module Snmp4jConfigMib is NOT added to the agent by calling the initOptionalMIBs. Using the AgentConfigManager this is the default. To change that overwrite that method as shown by the second snippet:
/**
* Creates the instances of the optional MIB modules of this agent (SNMP4J-LOG-MIB,
* SNMP4J-CONFIG-MIB, NOTIFICATION-LOG-MIB, SNMP4J-PROXY-MIB, and SNMP-USM-DH-OBJECTS-MIB).
*/
protected void initOptionalMIBs() {
initSnmp4jLogMIB();
initSnmp4jConfigMIB(null);
if ((vacm() != null) && (notificationMIB != null)) {
initNotificationLogMIB(vacm(), notificationMIB);
}
initSnmp4jProxyMIB(getDefaultContext());
initSnmpUsmDhObjectsMib();
}
agent = new AgentConfigManager(
engineID,
messageDispatcher,
null,
moServers,
ThreadPool.create("SampleAgent", 3),
configurationFactory,
persistenceProvider, engineBootsProvider,
null, dhKickstartParameters) {
@Override
protected void initOptionalMIBs() {
initSnmp4jLogMIB();
if ((vacm() != null) && (notificationMIB != null)) {
initNotificationLogMIB(vacm(), notificationMIB);
}
initSnmpUsmDhObjectsMib();
}
@Override
protected Session createSnmpSession(MessageDispatcher dispatcher) {
Session session = super.createSnmpSession(dispatcher);
snmpConfigurator.configure(session, getUsm(), messageDispatcher, args);
return session;
}
};
- If the do not want to change the code basis and Snmp4jConfigMib is part of the deployed agent then you need to exclude the access for the snmp4jCfgStorageTable from all view unrestricted views (check if other/custom views need to be changed too):
VacmMIB vacm = agent.getVacmMIB();
OID excluded = new OID("1.3.6.1.4.1.4976.10.1.1.2.1.2.1");
OctetString noMask = new OctetString(); // zero length => all sub-IDs significant
vacm.addViewTreeFamily(new OctetString("unrestrictedReadView"), excluded, noMask,
VacmMIB.vacmViewExcluded, StorageType.readOnly);
vacm.addViewTreeFamily(new OctetString("unrestrictedWriteView"), excluded, noMask,
VacmMIB.vacmViewExcluded, StorageType.readOnly);
vacm.addViewTreeFamily(new OctetString("unrestrictedNotifyView"), excluded, noMask,
VacmMIB.vacmViewExcluded, StorageType.readOnly);
...
You can apply these changes using a SNMP client (with full MIB access and auth/priv) during runtime as well. If you want them to be applied at compile time, place them here:
agent.configure();
agent.restoreState();
addVacmExclusions(); // the four statements above
agent.launch();
To fix this at runtime execute the following script with an user in unrestricted write view (for example SHA256AES128:
AGENT=127.0.0.1:4700 # must match the SampleAgent listen address argument
PASS='<the -admin passkey>'
V3="-v3 -l authPriv -u SHA256AES128 -a SHA-256 -A $PASS -x AES -X $PASS"
VTF=1.3.6.1.6.3.16.1.5.2.1 # vacmViewTreeFamilyEntry
RV=20.117.110.114.101.115.116.114.105.99.116.101.100.82.101.97.100.86.105.101.119.14.1.3.6.1.4.1.4976.10.1.1.2.1.2.1
WV=21.117.110.114.101.115.116.114.105.99.116.101.100.87.114.105.116.101.86.105.101.119.14.1.3.6.1.4.1.4976.10.1.1.2.1.2.1
NV=22.117.110.114.101.115.116.114.105.99.116.101.100.78.111.116.105.102.121.86.105.101.119.14.1.3.6.1.4.1.4976.10.1.1.2.1.2.1
# 1) unrestrictedReadView
snmpset $V3 $AGENT $VTF.4.$RV i 2 $VTF.5.$RV i 3 $VTF.6.$RV i 4
# 2) unrestrictedWriteView
snmpset $V3 $AGENT $VTF.4.$WV i 2 $VTF.5.$WV i 3 $VTF.6.$WV i 4
# 3) unrestrictedNotifyView
snmpset $V3 $AGENT $VTF.4.$NV i 2 $VTF.5.$NV i 3 $VTF.6.$NV i 4
A back port of the Snmp4jConfigMib hardening will be released in a few days. Excluding the snmp4jCfgMIB (1.3.6.1.4.1.4976.10.1.1.2) from all non-admin MIB views makes sense in any case!