This issue does not affect versions of Net-SNMP before 5.8.5. Upgrade to a more recent version. This issue has been assigned CVE-2017-16758. A remote attacker may be able to exploit this vulnerability to crash a Net-SNMP instance via a crafted UDP packet, resulting in Denial of Service. CVE-2017-14927 The ipv6_find_1stfragopt function in mib-ipv6.c in Net-SNMP 5.8 through 5.9.3 has a buffer overflow. It is possible to create a specially crafted SNMP request that could cause the SNMP daemon to crash when it processes the request. This could be exploited in a DoS attack.
CVE-2017-14928 In Net-SNMP 5.8 through 5.9.3, the snmp_parse_addr function in snmp.c has a buffer overflow. It is possible to create a specially crafted SNMP request that could cause the SNMP daemon to crash when it processes the request. This could be exploited in a DoS attack.
CVE-2017-14929 In Net-SNMP 5.8 through 5.9.3, the snmp_get_v1_community function in mib-v1.c has a buffer overflow. It is possible to create a specially crafted SNMP request that could cause the SNMP daemon to crash when it processes the request
SNMPv3 Issues
CVE-2017-16758 In Net-SNMP 5.8 through 5.9.3, the ipv6_find_1stfragopt function in mib-ipv6.c has a buffer overflow. A remote attacker may be able to exploit this vulnerability to crash a Net-SNMP instance via a crafted UDP packet, resulting in Denial of Service.
CVE-2017-14927 The ipv6_find_1stfragopt function in mib-ipv6.c in Net-SNMP 5.8 through 5.9.3 has a buffer overflow. It is possible to create a specially crafted SNMP request that could cause the SNMP daemon to crash when it processes the request
CVE-2017-15212 In Net-SNMP 5.8 through 5.9, snmpd before 507, and snmpset before 461, allow remote attackers to cause an arbitrary write by using as many as 16 threads simultaneously to access certain memory locations such as the location of an ASN or IPCP table entry via unspecified vectors related to "hash tables."
SNMP V5: Net-SNMP 5.8 through 5.9.3
SNMP Overview
SNMP, also known as Simple Network Management Protocol, is a network management protocol for use in monitoring and managing networks of almost any size. It was developed as an easier way to monitor and manage network devices such as routers. SNMP provides a simple text-based user interface that can be used by humans or automated scripts to query and configure the state of devices on the network.
All modern operating systems contain built-in support for SNMP. This allows them to act as SNMP agents which allow an outside system like a "Super Server" application to monitor and configure multiple devices on the local machine or across the entire network.
Timeline
Published on: 11/07/2022 03:15:00 UTC
Last modified on: 11/08/2022 04:24:00 UTC