Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2012-6151 CVE-2014-2284 |
CWE-ID | CWE-399 CWE-20 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU33299
Risk: Medium
CVSSv3.1: 4.8 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2012-6151
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: Yes
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
net-snmp-5.5-49.18.amzn1.i686
net-snmp-libs-5.5-49.18.amzn1.i686
net-snmp-utils-5.5-49.18.amzn1.i686
net-snmp-perl-5.5-49.18.amzn1.i686
net-snmp-devel-5.5-49.18.amzn1.i686
net-snmp-debuginfo-5.5-49.18.amzn1.i686
net-snmp-python-5.5-49.18.amzn1.i686
src:
net-snmp-5.5-49.18.amzn1.src
x86_64:
net-snmp-debuginfo-5.5-49.18.amzn1.x86_64
net-snmp-python-5.5-49.18.amzn1.x86_64
net-snmp-perl-5.5-49.18.amzn1.x86_64
net-snmp-utils-5.5-49.18.amzn1.x86_64
net-snmp-devel-5.5-49.18.amzn1.x86_64
net-snmp-libs-5.5-49.18.amzn1.x86_64
net-snmp-5.5-49.18.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2014-316.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU32558
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2014-2284
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.
MitigationUpdate the affected packages:
i686:Vulnerable software versions
net-snmp-5.5-49.18.amzn1.i686
net-snmp-libs-5.5-49.18.amzn1.i686
net-snmp-utils-5.5-49.18.amzn1.i686
net-snmp-perl-5.5-49.18.amzn1.i686
net-snmp-devel-5.5-49.18.amzn1.i686
net-snmp-debuginfo-5.5-49.18.amzn1.i686
net-snmp-python-5.5-49.18.amzn1.i686
src:
net-snmp-5.5-49.18.amzn1.src
x86_64:
net-snmp-debuginfo-5.5-49.18.amzn1.x86_64
net-snmp-python-5.5-49.18.amzn1.x86_64
net-snmp-perl-5.5-49.18.amzn1.x86_64
net-snmp-utils-5.5-49.18.amzn1.x86_64
net-snmp-devel-5.5-49.18.amzn1.x86_64
net-snmp-libs-5.5-49.18.amzn1.x86_64
net-snmp-5.5-49.18.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2014-316.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.