CVE-2022-44793

handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
net-snmpnet-snmp
5.4.3 ≤
𝑥
≤ 5.9.3
debiandebian_linux
10.0
netapph300s_firmware
-
netapph500s_firmware
-
netapph700s_firmware
-
netapph410s_firmware
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
net-snmp
bullseye (security)
vulnerable
bullseye
no-dsa
bookworm
5.9.3+dfsg-2
fixed
sid
5.9.4+dfsg-1.1
fixed
trixie
5.9.4+dfsg-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
net-snmp
lunar
Fixed 5.9.3+dfsg-1ubuntu4
released
kinetic
Fixed 5.9.3+dfsg-1ubuntu1.2
released
jammy
Fixed 5.9.1+dfsg-1ubuntu2.4
released
focal
Fixed 5.8+dfsg-2ubuntu2.6
released
bionic
Fixed 5.7.3+dfsg-1.8ubuntu3.8
released
xenial
Fixed 5.7.3+dfsg-1ubuntu4.6+esm1
released
trusty
Fixed 5.7.2~dfsg-8.1ubuntu3.3+esm3
released
Common Weakness Enumeration
References
https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f
https://github.com/net-snmp/net-snmp/issues/475
https://lists.debian.org/debian-lts-announce/2023/01/msg00010.html
https://security.netapp.com/advisory/ntap-20230223-0011/
https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f
https://github.com/net-snmp/net-snmp/issues/475
https://lists.debian.org/debian-lts-announce/2023/01/msg00010.html
https://security.netapp.com/advisory/ntap-20230223-0011/