SB2020020402 - Multiple vulnerabilities in Mini SNMP daemon
Published: February 4, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2020-6058)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the "decode_cnt" function when processing SNMP packets. A remote attacker can send a specially crafted SNMP request, trigger out-of-bounds read error, read contents of memory on the system and cause a denial of service (DoS) condition.
2) Stack-based buffer overflow (CVE-ID: CVE-2020-6060)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when the affected system handles multiple connections. A remote unauthenticated attacker can use a specially timed sequence of SNMP connections, trigger stack-based buffer overflow and cause a denial of service condition on the target system.
3) Out-of-bounds read (CVE-ID: CVE-2020-6059)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the "decode_int" function when processing SNMP packets. A remote attacker can send a specially crafted SNMP request, trigger out-of-bounds read error, read contents of memory on the system and cause a denial of service (DoS) condition.
Remediation
Install update from vendor's website.