Double Free in Net-snmp - CVE-2019-20892

Vulnerability identifier: #VU29535

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-20892

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing an SNMPv3 GetBulk request in usm_free_usmStateReference in snmplib/snmpusm.c in net-snmp. A remote attacker can pass specially crafted data to the application, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Net-snmp
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
libsnmp-base (Ubuntu package)
libsnmp-perl (Ubuntu package)
libsnmp35 (Ubuntu package)
snmpd (Ubuntu package)
net-snmp
net-snmp-debuginfo
net-snmp-debugsource
net-snmp-devel
net-snmp-gui
net-snmp-help
net-snmp-libs
net-snmp-perl
python3-net-snmp
net-snmp (Red Hat package)
BIG-IP Link Controller
BIG-IP DNS
BIG-IP AAM
BIG-IP Advanced WAF
BIG-IP GTM
BIG-IP FPS
BIG-IP ASM
BIG-IP APM
BIG-IP Analytics
BIG-IP AFM
BIG-IP LTM
BIG-IP PEM
BIG-IP DDHD
BIG-IP SSLO

Install updates from vendor's website.

Net-snmp - update to 5.8.1.pre1
libsnmp-base (Ubuntu package) - update to 5.8+dfsg-2ubuntu2.1
libsnmp-perl (Ubuntu package) - update to 5.8+dfsg-2ubuntu2.1
libsnmp35 (Ubuntu package) - update to 5.8+dfsg-2ubuntu2.1
snmpd (Ubuntu package) - update to 5.8+dfsg-2ubuntu2.1
net-snmp - update to 5.8-10
net-snmp-debuginfo - update to 5.8-10
net-snmp-debugsource - update to 5.8-10
net-snmp-devel - update to 5.8-10
net-snmp-gui - update to 5.8-10
net-snmp-help - update to 5.8-10
net-snmp-libs - update to 5.8-10
net-snmp-perl - update to 5.8-10
python3-net-snmp - update to 5.8-10
net-snmp (Red Hat package) - update to 5.8-12.el8_1.1

• http://www.openwall.com/lists/oss-security/2020/06/25/4
• https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027
• https://bugzilla.redhat.com/show_bug.cgi?id=1663027
• https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9
• https://sourceforge.net/p/net-snmp/bugs/2923/

• Remote code execution in net-snmp
• Red Hat Enterprise Linux 8 update for net-snmp
• Gentoo update for Net-SNMP
• Double free in SNMP package in F5 BIG-IP products
• openEuler 20.03 LTS update for net-snmp-5.8-9
• Ubuntu update for net-snmp