Description
The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | net-snmp | 5.7.2~dfsg-3 | — |
| Debian 13 | net-snmp | 5.7.2~dfsg-3 | — |
| Debian 12 | net-snmp | 5.7.2~dfsg-3 | — |
Advisories 1
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- 57870 third-party-advisory
- http://sourceforge.net/p/net-snmp/patches/1113/
- [oss-security] 20140306 CVE request: net-snmp agentx incorrect handling of multi-object requests DoS mailing-list
- http://sourceforge.net/p/net-snmp/code/ci/eb816330a1887798d844d2fd5dc6482002123cbd/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388
- [oss-security] 20140307 Re: CVE request: net-snmp agentx incorrect handling of multi-object requests DoS mailing-list
- USN-2166-1 vendor-advisory