CVE-2022-24805
Description
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
How to fix
- net-snmp net-snmp5.9.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net-snmp net-snmp | v < 5.9.2 | 5.9.2 |
| fedoraproject fedora | 36 | — |
| debian debian_linux | 10.0, 11.0 | — |
| redhat enterprise_linux | 9.0 | — |
| redhat enterprise_linux_eus | 9.2, 9.4 | — |
| redhat enterprise_linux_for_arm_64 | 9.0, 9.2_aarch64, 9.4_aarch64 | — |
| redhat enterprise_linux_for_arm_64_eus | 9.4_aarch64 | — |
| redhat enterprise_linux_for_ibm_z_systems | 9.0, 9.2_s390x, 9.4_s390x | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x | — |
| redhat enterprise_linux_for_power_little_endian | 9.0 | — |
| redhat enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le, 9.4_ppc64le | — |
| redhat enterprise_linux_server_aus | 9.2, 9.4 | — |
| redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.2_ppc64le | — |
| redhat enterprise_linux_server_update_services_for_sap_solutions | 9.2 | — |
| redhat enterprise_linux_update_services_for_sap_solutions | 9.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.