Description
The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | net-snmp | 5.4.3~dfsg-1 | — |
| Debian 13 | net-snmp | 5.4.3~dfsg-1 | — |
| Debian 12 | net-snmp | 5.4.3~dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | net-snmp +4 | 5.0.9-2.30E.27 | RHSA-2009:0295 |
Advisories 2
- RHSA-2009:0295 Red Hat Security Advisory: net-snmp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- [oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure) mailing-list
- [oss-security] 20090212 Re: CVE Request -- net-snmp (sensitive host information disclosure) mailing-list
- http://bugs.gentoo.org/show_bug.cgi?id=250429
- https://bugzilla.redhat.com/show_bug.cgi?id=485211
- [oss-security] Re: 20090212 CVE Request -- net-snmp (sensitive host information disclosure) mailing-list
- SUSE-SR:2009:011 vendor-advisory
- SUSE-SR:2010:003 vendor-advisory
- RHSA-2009:0295 vendor-advisory
- 35685 third-party-advisory
- 34499 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- 35416 third-party-advisory
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367
- oval:org.mitre.oval:def:10289 vdb-entry signature
- 1021921 vdb-entry
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367