Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 6 |
CVE-ID | CVE-2022-24810 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24809 CVE-2022-24805 |
CWE-ID | CWE-476 CWE-787 CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Net-snmp Server applications / Remote management servers, RDP, SSH |
Vendor | net-snmp.sourceforge.net |
This security bulletin contains information about 6 vulnerabilities.
EUVDB-ID: #VU65676
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-24810
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in nsVacmAccessTable when handling malformed OID in a SET request. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24810
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65675
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-24808
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in NET-SNMP-AGENT-MIB::nsLogTable when handling malformed OID in a SET request. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24808
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65674
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-24807
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a boundary error in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable. A remote user can pass a malformed OID in a SET request, trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24807
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65673
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-24806
CWE-ID:
CWE-20 - Improper Input Validation
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when SETing malformed OIDs in master agent and subagent simultaneously. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24806
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65672
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2022-24809
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in nsVacmAccessTable when handling malformed OID in GET-NEXT. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-24809
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU65671
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-24805
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when handling INDEX of NET-SNMP-VACM-MIB. A remote attacker can trick the victim into loading a specially crafted MIB collection, trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNet-snmp: 5.0 - 5.9.verfix
http://bugzilla.redhat.com/show_bug.cgi?id=2103225
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?