Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1111154

Bug#1016139: net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805

Show all headers | View raw

Source: net-snmp
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for net-snmp.

5.9.3 fixes the following issues:

- These two CVEs can be exploited by a user with read-only credentials:
    - CVE-2022-24805 A buffer overflow in the handling of the INDEX of
      NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
    - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable
      can cause a NULL pointer dereference.
    - These CVEs can be exploited by a user with read-write credentials:
        - CVE-2022-24806 Improper Input Validation when SETing malformed
          OIDs in master agent and subagent simultaneously
        - CVE-2022-24807 A malformed OID in a SET request to
          SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
          out-of-bounds memory access.
        - CVE-2022-24808 A malformed OID in a SET request to
          NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
        - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable
          can cause a NULL pointer dereference.
   - To avoid these flaws, use strong SNMPv3 credentials and do not share them.
     If you must use SNMPv1 or SNMPv2c, use a complex community string
     and enhance the protection by restricting access to a given IP address range.
   - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for
     reporting the following CVEs that have been fixed in this release, and
     to Arista Networks for providing fixes.

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1016139: net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-27 23:00 +0200
  Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-29 16:40 +0200

csiph-web