Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA82973 advisory.

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind     variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
    (CVE-2015-5621)

  - The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using     TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote     attackers to bypass intended access restrictions and execute SNMP queries, related to source/destination     IP address confusion. (CVE-2008-6123)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.
    (CVE-2020-15861)

  - _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that     can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet,     resulting in Denial of Service. (CVE-2018-18065)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-232:01 advisory.

    SNMP (Simple Network Management Protocol) is a protocol used for network management. The NET-SNMP project     includes various SNMP tools: an extensible agent, an SNMP library, tools for requesting or setting     information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat     command which uses SNMP, and a Tk/Perl mib browser. This package contains the snmpd and snmptrapd daemons,     documentation, etc.
    You will probably also want to install the net-snmp-utils package, which contains NET-SNMP utilities.
    Building option:
    --without tcp_wrappers : disable tcp_wrappers support     Security issues fixed with this release:
     CVE-2012-6151      Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests,     allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang)     by causing the AgentX subagent to timeout.
     CVE-2014-2285      No information available at the time of writing, please refer to the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.1 and is affected by multiple vulnerabilities in the following components :

 - Accelerate Framework (CVE-2015-5940)
 - apache_mod_php (CVE-2015-0235, CVE-2015-0273, CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838)
 - ATS (CVE-2015-6985)
 - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)
 - Bom (CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Directory Utility (CVE-2015-6980)
 - Disk Images (CVE-2015-6995)
 - EFI (CVE-2015-7035)
 - File Bookmark (CVE-2015-6987)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Drivers (CVE-2015-7019, CVE-2015-7020, CVE-2015-7021)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5938, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)
 - libarchive (CVE-2015-6984)
 - MCX Application Restrictions (CVE-2015-7016)
 - Net-SNMP (CVE-2014-3565, CVE-2012-6151)
 - OpenGL (CVE-2015-5924)
 - OpenSSH (CVE-2015-6563)
 - Sandbox (CVE-2015-5945)
 - Script Editor (CVE-2015-7007)
 - Security (CVE-2015-6983, CVE-2015-7024)
 - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.9.5 or later but prior to 10.11.1 It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework (CVE-2015-5940)

  - apache_mod_php (CVE-2015-0235, CVE-2015-0273,     CVE-2015-6834, CVE-2015-6835, CVE-2015-6836,     CVE-2015-6837, CVE-2015-6838)

  - ATS (CVE-2015-6985)

  - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)

  - Bom (CVE-2015-7006)

  - CFNetwork (CVE-2015-7023)

  - configd (CVE-2015-7015)

  - CoreGraphics (CVE-2015-5925, CVE-2015-5926)

  - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992,     CVE-2015-7017)

  - Directory Utility (CVE-2015-6980)

  - Disk Images (CVE-2015-6995)

  - EFI (CVE-2015-7035)

  - File Bookmark (CVE-2015-6987)

  - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976,     CVE-2015-6977, CVE-2015-6978, CVE-2015-6990,     CVE-2015-6991, CVE-2015-6993, CVE-2015-7008,     CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)

  - Grand Central Dispatch (CVE-2015-6989)

  - Graphics Drivers (CVE-2015-7019, CVE-2015-7020,     CVE-2015-7021)

  - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937,     CVE-2015-5938, CVE-2015-5939)

  - IOAcceleratorFamily (CVE-2015-6996)

  - IOHIDFamily (CVE-2015-6974)

  - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)

  - libarchive (CVE-2015-6984)

  - MCX Application Restrictions (CVE-2015-7016)

  - Net-SNMP (CVE-2014-3565, CVE-2012-6151)

  - OpenGL (CVE-2015-5924)

  - OpenSSH (CVE-2015-6563)

  - Sandbox (CVE-2015-5945)

  - Script Editor (CVE-2015-7007)

  - Security (CVE-2015-6983, CVE-2015-7024)

  - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout. (CVE-2012-6151)

The remote Solaris system is missing necessary patches to address security updates :

  - Net-SNMP 5.7.1 and earlier, when AgentX is registering     to handle a MIB and processing GETNEXT requests, allows     remote attackers to cause a denial of service (crash or     infinite loop, CPU consumption, and hang) by causing the     AgentX subagent to timeout. (CVE-2012-6151)

The remote Solaris system is missing necessary patches to address security updates :

  - Net-SNMP 5.7.1 and earlier, when AgentX is registering     to handle a MIB and processing GETNEXT requests, allows     remote attackers to cause a denial of service (crash or     infinite loop, CPU consumption, and hang) by causing the     AgentX subagent to timeout. (CVE-2012-6151)

  - The AgentX subagent in Net-SNMP before 5.4.4 allows     remote attackers to cause a denial of service (hang) by     sending a multi-object request with an Object ID (OID)     containing more subids than previous requests, a     different vulnerability than CVE-2012-6151.
    (CVE-2014-2310)

The remote host is affected by the vulnerability described in GLSA-201409-02 (Net-SNMP: Denial of Service)

    Multiple vulnerabilities have been discovered in Net-SNMP. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could create a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Ken Farnen discovered that Net-SNMP incorrectly handled AgentX timeouts. A remote attacker could use this issue to cause the server to crash or to hang, resulting in a denial of service. (CVE-2012-6151)

It was discovered that the Net-SNMP ICMP-MIB incorrectly validated input. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 13.10. (CVE-2014-2284)

Viliam Pucik discovered that the Net-SNMP perl trap handler incorrectly handled NULL arguments. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service.
(CVE-2014-2285)

It was discovered that Net-SNMP incorrectly handled AgentX multi-object requests. A remote attacker could use this issue to cause the server to hang, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 12.10.
(CVE-2014-2310).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow flaw was found in the way the decode_icmp_msg() function in the ICMP-MIB implementation processed Internet Control Message Protocol (ICMP) message statistics reported in the /proc/net/snmp file. A remote attacker could send a message for each ICMP message type, which could potentially cause the snmpd service to crash when processing the /proc/net/snmp file. (CVE-2014-2284)

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151)

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp- perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285)

After installing this update, the snmpd and snmptrapd services will be restarted automatically.

Updated net-snmp packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151)

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp-perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285)

All net-snmp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the snmpd and snmptrapd services will be restarted automatically.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0322 advisory.

    - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in       the middle of request processing (#1073224)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated net-snmp packages fix security vulnerability :

Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout (CVE-2012-6151).

This update also fixes two other minor issues: IPADDRESS size in python-netsnmp on 64-bit systems and adding btrfs support to hrFSTable.

This update fixes CVE-2012-6151 :

  - snmpd crashes/hangs when AgentX subagent times-out

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
310756	Juniper Junos OS Multiple Vulnerabilities (JSA82973)	Nessus	Junos Local Security Checks	Combined	high
290079	MiracleLinux 3 : net-snmp-5.3.2.2-22.1.0.1.AXS3 (AXSA:2014-232:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
9324	Mac OS X 10.9.5 or later < 10.11.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		critical
86654	Mac OS X < 10.11.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
82932	F5 Networks BIG-IP : NET-SNMP vulnerability (K16476)	Nessus	F5 Networks Local Security Checks	Local	medium
80707	Oracle Solaris Third-Party Patch Update : net-snmp (cve_2012_6151_resource_management)	Nessus	Solaris Local Security Checks	Local	medium
80706	Oracle Solaris Third-Party Patch Update : net-snmp (multiple_vulnerabilities_in_net_snmp)	Nessus	Solaris Local Security Checks	Local	medium
77471	GLSA-201409-02 : Net-SNMP: Denial of Service	Nessus	Gentoo Local Security Checks	Local	medium
73513	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : net-snmp vulnerabilities (USN-2166-1)	Nessus	Ubuntu Local Security Checks	Local	medium
73235	Amazon Linux AMI : net-snmp (ALAS-2014-316)	Nessus	Amazon Linux Local Security Checks	Local	medium
73176	Scientific Linux Security Update : net-snmp on SL5.x i386/x86_64 (20140324)	Nessus	Scientific Linux Local Security Checks	Local	medium
73175	RHEL 5 : net-snmp (RHSA-2014:0322)	Nessus	Red Hat Local Security Checks	Local	medium
73173	Oracle Linux 5 : net-snmp (ELSA-2014-0322)	Nessus	Oracle Linux Local Security Checks	Local	medium
73163	CentOS 5 : net-snmp (CESA-2014:0322)	Nessus	CentOS Local Security Checks	Local	medium
72101	Mandriva Linux Security Advisory : net-snmp (MDVSA-2014:017)	Nessus	Mandriva Local Security Checks	Local	medium
71853	Fedora 18 : net-snmp-5.7.2-7.fc18 (2013-22949)	Nessus	Fedora Local Security Checks	Local	medium
71852	Fedora 19 : net-snmp-5.7.2-13.fc19 (2013-22919)	Nessus	Fedora Local Security Checks	Local	medium
71851	Fedora 20 : net-snmp-5.7.2-16.fc20 (2013-22809)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2012-6151

critical

Tenable Plugins

high

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium