net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 | patch |
| https://bugzilla.redhat.com/show_bug.cgi?id=2103225 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2105238 | third party advisory |
| https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html | third party advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ | product |
| https://security.gentoo.org/glsa/202210-29 | third party advisory |
| https://www.debian.org/security/2022/dsa-5209 | third party advisory |
| https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 | patch |