CVE-2022-24809

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a GET-NEXT to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. The suite includes:

•   - An extensible agent for responding to SNMP queries including built-in
  

•   support for a wide range of MIB information modules
  

•   - Command-line applications to retrieve and manipulate information from
  

•   SNMP-capable devices
  

•   - A daemon application for receiving SNMP notifications
  

•   - A library for developing new SNMP applications, with C and Perl APIs
  

•   - A graphical MIB browser.
  

Security Fix(es):

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24809)

CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES(CVE-2022-24807)

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES

CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference(CVE-2022-24808)

+5.9.2:

• security:

•  - These two CVEs can be exploited by a user with read-only credentials:
  

•      - CVE-2022-24805 A buffer overflow in the handling of the INDEX of
  

•        NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
  

•      - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable
  

•        can cause a NULL pointer dereference.
  

•  - These CVEs can be exploited by a user with read-write credentials:
  

•      - CVE-2022-24806 Improper Input Validation when SETing malformed
  

•        OIDs in master agent and subagent simultaneously
  

•      - CVE-2022-24807 A malformed OID in a SET request to
  

•        SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
  

•        out-of-bounds memory access.
  

•      - CVE-2022-24808 A malformed OID in a SET request to
  

•        NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
  

•      - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable
  

•        can cause a NULL pointer dereference.
  

•  - To avoid these flaws, use strong SNMPv3 credentials and do not share them.
  

•    If you must use SNMPv1 or SNMPv2c, use a complex community string
  

•    and enhance the protection by restricting access to a given IP address range.
  

•  - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for
  

•    reporting the following CVEs that have been fixed in this release, and
  

•    to Arista Networks for providing fixes.(CVE-2022-24805)
  

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24810)

From https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously(CVE-2022-24806)

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a GET-NEXT to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

• net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805)
• : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806)
• net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807)
• net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809)
• net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808)
• net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805) Buffer overflow and out of bounds memory access. (CVE-2022-24806) A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. (CVE-2022-24807) A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference. (CVE-2022-24808) A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809) A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)

These are all security issues fixed in the libsnmp40-32bit-5.9.2-1.1 package on the GA media of openSUSE Tumbleweed.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

• net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805)

• : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806)

• net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807)

• net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809)

• net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808)

• net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for net-snmp fixes the following issues:

Update to net-snmp-5.9.4 (bsc#1214364 jsc#PED-6435).

• 5.9.4:

  • libsnmp:

    • Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not used in the Net-SNMP code base.
    • DISPLAY-HINT fixes
    • Miscellanious improvements to the transports
    • Handle multiple oldEngineID configuration lines
    • fixes for DNS names longer than 63 characters

  • agent:

    • Added a ignoremount configuration option for the HOST-MIB
    • disallow SETs with a NULL varbind
    • fix the --enable-minimalist build

  • apps:

    • snmpset: allow SET with NULL varbind for testing
    • snmptrapd: improved MySQL logging code

  • general:

    • configure: Remove -Wno-deprecated as it is no longer needed
    • miscellanious ther bug fixes, build fixes and cleanups

  • security:

    • These two CVEs can be exploited by a user with read-only credentials:

      • CVE-2022-24805�A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
      • CVE-2022-24809�A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.

    • These CVEs can be exploited by a user with read-write credentials:

      • CVE-2022-24806�Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously
      • CVE-2022-24807�A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.
      • CVE-2022-24808�A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
      • CVE-2022-24810�A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

    • To avoid these flaws, use strong SNMPv3 credentials and do not share them. If you must use SNMPv1 or SNMPv2c, use a complex community string and enhance the protection by restricting access to a given IP address range.

    • Thanks are due to�Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for reporting the following CVEs that have been fixed in this release, and to Arista Networks for providing fixes.

    • IF-MIB: Update ifTable entries even if the interface name has changed At least on Linux a network interface index may be reused for a network interface with a different name. Hence this patch that enables replacing network interface information even if the network interface name has changed.

    • unspecified:

      • Moved transport code into a separate subdirectory in snmplib
      • Snmplib: remove inline versions of container funcs'.

    • misc:

      • snmp-create-v3-user: Fix the snmpd.conf path @datadir@ is expanded in ${datarootdir} so datarootdir must be set before @datadir@ is used.

• 5.9:

  • snmplib:

    • Add IPv6 support to DTLSUDP transport
    • use new netsnmp_sockaddr_storage in netsnmp_addr_pair
    • add base_transport ptr for tunneled transports
    • Dtls: overhaul of debug
    • Remove inline versions of container funcs

  • snmpd:

    • Use ETHTOOL_GLINKSETTINGS when available Newer Linux kernels support ETHTOOL_GLINKSETTINGS. Use it when available instead of the older and deprecated ETHTOOL_GSET. This patch avoids that the Linux kernel reports the following kernel warning: warning: 'snmpd' uses legacy ethtool link settings API, link modes are only partially reported See also https://sourceforge.net/p/net-snmp/patches/1387/.
    • [BUG 2926]: Make it possible to set agentXPingInterval for a subagent - register agentXPingInterval for the subagent list handler, before it was registered for snmp - added agentxTimeout to the subagent list handler. It's now possible to set for snmpd and the subagent. See 'man snmpd.conf' -…

This update for net-snmp fixes the following issues:

Updated to version 5.9.3 (bsc#1201103, jsc#SLE-11203):

• CVE-2022-24805: Fixed a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB that can cause an out-of-bounds memory access.
• CVE-2022-24809: Fixed a malformed OID in a GET-NEXT to the nsVacmAccessTable that can cause a NULL pointer dereference.
• CVE-2022-24806: Fixed an improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously.
• CVE-2022-24807: Fixed a malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.
• CVE-2022-24808: Fixed a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference.
• CVE-2022-24810: Fixed a malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

This update for net-snmp fixes the following issues:

Updated to version 5.9.3 (bsc#1201103, jsc#SLE-11203):

• CVE-2022-24805: Fixed a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB that can cause an out-of-bounds memory access.
• CVE-2022-24809: Fixed a malformed OID in a GET-NEXT to the nsVacmAccessTable that can cause a NULL pointer dereference.
• CVE-2022-24806: Fixed an improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously.
• CVE-2022-24807: Fixed a malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.
• CVE-2022-24808: Fixed a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference.
• CVE-2022-24810: Fixed a malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-5795-1 and 5543-1 fixed several vulnerabilities in Net-SNMP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Net-SNMP incorrectly handled certain requests. A remote attacker could possibly use these issues to cause Net-SNMP to crash, resulting in a denial of service.

Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled memory operations when processing certain requests. A remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute arbitrary code.