REDHAT-BUG-2141898: Medium severity Net-SNMP Net-SNMP vulnerability

Q: Which deployments are exposed to this issue?

Net-SNMP versions 5.4.3 through 5.9.3 are identified as affected. Exposure requires a Net-SNMP instance that can receive attacker-supplied UDP packets remotely.

Q: What does an attacker need to do to exploit it?

A remote attacker can trigger the NULL pointer exception by sending a crafted UDP packet to the affected Net-SNMP instance. No additional prerequisites are stated in the available data.

Q: What is the impact of successful exploitation?

Successful exploitation can crash the affected instance, causing a denial of service.

Published Nov 11, 2022

Updated

handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

https://github.com/net-snmp/net-snmp/issues/475 https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f

Affected Software

1 affected component

Net-SNMP Net-SNMP>=5.4.3<=5.9.3

Event History

Nov 11, 2022

Data Sourced

via Red Hat·04:21 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Net-SNMP versions 5.4.3 through 5.9.3 are identified as affected. Exposure requires a Net-SNMP instance that can receive attacker-supplied UDP packets remotely.

What does an attacker need to do to exploit it?

A remote attacker can trigger the NULL pointer exception by sending a crafted UDP packet to the affected Net-SNMP instance. No additional prerequisites are stated in the available data.

What is the impact of successful exploitation?