REDHAT-BUG-2141897: Medium severity Net-SNMP Net-SNMP vulnerability
Published Nov 11, 2022
·Updated
handleipDefaultTTL in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
https://github.com/net-snmp/net-snmp/issues/474 https://gist.github.com/menglong2234/b7bc13ae1a144f47cc3c95a7ea062428
Affected Software
1 affected component
Net-SNMP Net-SNMP>=5.8<=5.9.3
Event History
Nov 11, 2022
Data Sourced
via Red Hat·04:18 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker who has write access to the affected Net-SNMP instance can exploit it by sending a crafted UDP packet.
2
What is the impact of successful exploitation?
Successful exploitation can trigger a NULL pointer exception and crash the Net-SNMP instance, causing a denial of service.
3
Which Net-SNMP versions are affected?
The issue affects Net-SNMP versions 5.8 through 5.9.3.