REDHAT-BUG-485211
First published: Thu Feb 12 2009(Updated: )
A possibility of sensitive host information disclosure was found in the implementation of SNMP protocol as defined in RFC 1065, RFC 1066, and RFC 1067. If the snmpd deamon was running on the host, it served the SNMP queries regardless of the fact, the IP address of the requester was not mentioned in the list of hosts allowed to issue / request SNMP MIB objects information. Remote attacker could use this flaw to gain host related sensitive information via performing a SNMP query. References: <a href="http://bugs.gentoo.org/show_bug.cgi?id=250429">http://bugs.gentoo.org/show_bug.cgi?id=250429</a> Upstream patch: <a href="http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367">http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CentOS Net-SNMP Agent Libraries |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.gentoo.org/show_bug.cgi?id=250429
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
- https://access.redhat.com/security/cve/CVE-2008-6123
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6123
- http://www.openwall.com/lists/oss-security/2009/02/12/2
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367
- https://rhn.redhat.com/errata/RHSA-2009-0295.html
- https://bugzilla.redhat.com/show_bug.cgi?id=485211
Frequently Asked Questions
What is the severity of REDHAT-BUG-485211?
The severity of REDHAT-BUG-485211 is considered high due to the potential for sensitive information disclosure.
How do I fix REDHAT-BUG-485211?
To fix REDHAT-BUG-485211, ensure that the SNMP daemon is not running or apply the latest security updates recommended by the vendor.
What systems are affected by REDHAT-BUG-485211?
REDHAT-BUG-485211 affects systems running the Net-SNMP implementation of the SNMP protocol.
What information can be disclosed due to REDHAT-BUG-485211?
Due to REDHAT-BUG-485211, sensitive host information such as system configurations and network details may be disclosed.
Is there a workaround for REDHAT-BUG-485211?
A possible workaround for REDHAT-BUG-485211 is to restrict access to the SNMP service by configuring firewall rules.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-6123
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/net-snmp
- canonical/centos net-snmp agent libraries