CVE-2022-24807
Medium
Description
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Net-snmp
PublishedApr 16, 2024
First seenApr 16, 2024
Weakness typeCWE-120CWE-120
How to fix
Update
- net-snmp net-snmp5.9.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net-snmp net-snmp | v < 5.9.2 | 5.9.2 |
| fedoraproject fedora | 36 | — |
| debian debian_linux | 10.0, 11.0 | — |
| redhat enterprise_linux | 9.0 | — |
| redhat enterprise_linux_eus | 9.2, 9.4 | — |
| redhat enterprise_linux_for_arm_64 | 9.0, 9.2_aarch64, 9.4_aarch64 | — |
| redhat enterprise_linux_for_arm_64_eus | 9.4_aarch64 | — |
| redhat enterprise_linux_for_ibm_z_systems | 9.0, 9.2_s390x, 9.4_s390x | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x | — |
| redhat enterprise_linux_for_power_little_endian | 9.0 | — |
| redhat enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le, 9.4_ppc64le | — |
| redhat enterprise_linux_server_aus | 9.2, 9.4 | — |
| redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.2_ppc64le | — |
| redhat enterprise_linux_server_update_services_for_sap_solutions | 9.2 | — |
| redhat enterprise_linux_update_services_for_sap_solutions | 9.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.