Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2008-6123 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Net-snmp Server applications / Remote management servers, RDP, SSH |
Vendor | net-snmp.sourceforge.net |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU32864
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2008-6123
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
MitigationInstall update from vendor's website.
Vulnerable software versionsNet-snmp: 5.0.9
External linkshttp://bugs.gentoo.org/show_bug.cgi?id=250429
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html
http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367
http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
http://secunia.com/advisories/34499
http://secunia.com/advisories/35416
http://secunia.com/advisories/35685
http://www.openwall.com/lists/oss-security/2009/02/12/2
http://www.openwall.com/lists/oss-security/2009/02/12/4
http://www.openwall.com/lists/oss-security/2009/02/12/7
http://www.redhat.com/support/errata/RHSA-2009-0295.html
http://www.securitytracker.com/id?1021921
http://bugzilla.redhat.com/show_bug.cgi?id=485211
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10289
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.