CVE-2022-24805
16.04.2024, 20:15
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
| Vendor | Product | Version |
|---|---|---|
| net-snmp | net-snmp | 𝑥 < 5.9.2 |
| net-snmp | net-snmp | 𝑥 < 5.9.2 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux_eus | 9.2 |
| redhat | enterprise_linux_eus | 9.4 |
| redhat | enterprise_linux_for_arm_64 | 9.0 |
| redhat | enterprise_linux_for_arm_64 | 9.2_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64 | 9.4_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64_eus | 9.4_aarch64:_aarch64 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.0 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.2_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems | 9.4_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.0 |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_aus | 9.2 |
| redhat | enterprise_linux_server_aus | 9.4 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.2_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 9.2 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.4 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References