CVE-2020-24361: Critical severity SNMPTT SNMPTT vulnerability
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/snmpttto a version that resolves this vulnerability.Fixed in 1.4-1ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/snmpttto a version that resolves this vulnerability.Fixed in 1.4-1ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/snmpttto a version that resolves this vulnerability.Fixed in 1.4-2ubuntu0.1~esm1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is network-reachable and requires no privileges or user interaction, according to the CVSS vector. An attacker can exploit it through the affected SNMPTT functionality involving EXEC, PREXEC, or unknown_trap_exec.
Which configurations are affected?
Configurations that use EXEC, PREXEC, or unknown_trap_exec are identified as vulnerable. The provided data does not establish whether a default SNMPTT configuration enables any of these directives.
What versions should be remediated?
SNMPTT versions before 1.4.2 are affected. Upgrade to 1.4.2 or a vendor-provided fixed package for the deployed operating system.