Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SNMP (Simple Network Management Protocol) is a protocol     used for network management. The NET-SNMP project     includes various SNMP tools: an extensible agent, an     SNMP library, tools for requesting or setting     information from SNMP agents, tools for generating and     handling SNMP traps, a version of the netstat command     which uses SNMP, and a Tk/Perl mib browser. This     package contains the snmpd and snmptrapd daemons,     documentation, etc. You will probably also want to     install the net-snmp-utils package, which contains     NET-SNMP utilities.Security Fix(es):Net-SNMP through     5.7.3 has Improper Privilege Management because SNMP     WRITE access to the EXTEND MIB provides the ability to     run arbitrary commands as root.(CVE-2020-15862)Net-SNMP     through 5.7.3 allows Escalation of Privileges because     of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the net package has been released.

USN-4471-1 fixed a vulnerability in Net-SNMP. The updated introduced a regression making nsExtendCacheTime not settable. This update fixes the problem adding the cacheTime feature flag.

Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks. An attacker could possibly use this issue to access sensitive information. (CVE-2020-15861) It was discovered that Net-SNMP incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-15862).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202008-12 (Net-SNMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Net-SNMP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks. An attacker could possibly use this issue to access sensitive information. (CVE-2020-15861) It was discovered that Net-SNMP incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-15862).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in net-snmp, a suite of Simple Network Management Protocol applications, which could lead to privilege escalation.

A privilege escalation vulnerability was discovered in Net-SNMP, a set of tools for collecting and organising information about devices on computer networks, due to incorrect symlink handling (CVE-2020-15861).

This security update also applies an upstream fix to their previous handling of CVE-2020-15862 as part of DLA-2299-1.

For Debian 9 'Stretch', these problems have been fixed in version 5.7.3+dfsg-1.7+deb9u3.

We recommend that you upgrade your net-snmp packages.

For the detailed security status of net-snmp please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/net-snmp

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
147698	EulerOS Virtualization 2.9.0 : net-snmp (EulerOS-SA-2021-1660)	Nessus	Huawei Local Security Checks	high
147440	EulerOS Virtualization 2.9.1 : net-snmp (EulerOS-SA-2021-1614)	Nessus	Huawei Local Security Checks	high
147126	EulerOS Virtualization 3.0.6.6 : net-snmp (EulerOS-SA-2021-1501)	Nessus	Huawei Local Security Checks	high
147123	EulerOS Virtualization for ARM 64 3.0.6.0 : net-snmp (EulerOS-SA-2021-1550)	Nessus	Huawei Local Security Checks	high
144715	EulerOS Virtualization for ARM 64 3.0.2.0 : net-snmp (EulerOS-SA-2021-1040)	Nessus	Huawei Local Security Checks	high
142257	EulerOS 2.0 SP2 : net-snmp (EulerOS-SA-2020-2370)	Nessus	Huawei Local Security Checks	high
142068	EulerOS 2.0 SP5 : net-snmp (EulerOS-SA-2020-2292)	Nessus	Huawei Local Security Checks	high
141335	EulerOS 2.0 SP9 : net-snmp (EulerOS-SA-2020-2179)	Nessus	Huawei Local Security Checks	high
141323	EulerOS 2.0 SP9 : net-snmp (EulerOS-SA-2020-2169)	Nessus	Huawei Local Security Checks	high
141003	EulerOS 2.0 SP8 : net-snmp (EulerOS-SA-2020-2155)	Nessus	Huawei Local Security Checks	high
140823	EulerOS 2.0 SP3 : net-snmp (EulerOS-SA-2020-2056)	Nessus	Huawei Local Security Checks	high
140457	Photon OS 3.0: Net PHSA-2020-3.0-0138	Nessus	PhotonOS Local Security Checks	high
140176	Ubuntu 16.04 LTS / 18.04 LTS : Net-SNMP regression (USN-4471-2)	Nessus	Ubuntu Local Security Checks	high
140115	Photon OS 2.0: Net PHSA-2020-2.0-0279	Nessus	PhotonOS Local Security Checks	high
140113	Photon OS 1.0: Net PHSA-2020-1.0-0318	Nessus	PhotonOS Local Security Checks	high
139888	GLSA-202008-12 : Net-SNMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
139784	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Net-SNMP vulnerabilities (USN-4471-1)	Nessus	Ubuntu Local Security Checks	high
139631	Debian DSA-4746-1 : net-snmp - security update	Nessus	Debian Local Security Checks	high
139341	Debian DLA-2313-1 : net-snmp security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-15861

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high