Resource management error in net-snmp.sourceforge.net Net-snmp



Published: 2013-12-13 | Updated: 2020-08-03
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2012-6151
CWE-ID CWE-399
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe
Net-snmp
Server applications / Remote management servers, RDP, SSH

Vendor net-snmp.sourceforge.net

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Resource management error

EUVDB-ID: #VU33299

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2012-6151

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Net-snmp: 5.7.0 - 5.7.1


CPE2.3 External links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
http://seclists.org/oss-sec/2013/q4/398
http://seclists.org/oss-sec/2013/q4/415
http://secunia.com/advisories/55804
http://secunia.com/advisories/57870
http://secunia.com/advisories/59974
http://sourceforge.net/p/net-snmp/bugs/2411/
http://www.gentoo.org/security/en/glsa/glsa-201409-02.xml
http://www.securityfocus.com/bid/64048
http://www.ubuntu.com/usn/USN-2166-1
http://bugzilla.redhat.com/show_bug.cgi?id=1038007
http://exchange.xforce.ibmcloud.com/vulnerabilities/89485
http://rhn.redhat.com/errata/RHSA-2014-0322.html
http://support.apple.com/HT205375

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###