net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 | patch |
| https://bugzilla.redhat.com/show_bug.cgi?id=2103225 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2105239 | third party advisory |
| https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html | third party advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ | product third party advisory |
| https://security.gentoo.org/glsa/202210-29 | third party advisory |
| https://www.debian.org/security/2022/dsa-5209 | third party advisory |
| https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 | patch |