The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2366 advisory.

  - A flaw was found in net-snmp. A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can     cause an out-of-bounds memory access issue. (CVE-2022-24805)

  - A flaw was found in net-snmp. This issue occurs due to improper input validation when simultaneously     setting malformed OIDs in the master agent and subagent. (CVE-2022-24806)

  - A flaw was found in net-snmp. A malformed OID in a SET request to the SNMP-VIEW-BASED-ACM-     MIB::vacmAccessTable can cause an out-of-bounds memory access issue. (CVE-2022-24807)

  - A flaw was found in net-snmp. A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause     a NULL pointer dereference issue. (CVE-2022-24808)

  - A flaw was found in net-snmp. A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL     pointer dereference issue. (CVE-2022-24809)

  - A flaw was found in net-snmp. A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer     dereference issue. (CVE-2022-24810)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : net-snmp (ALAS-2023-2366)

medium Nessus Plugin ID 186569

Version 1.1

Version 1.0

Version 1.1 Apr 17, 2024, 3:38 PM CVSS metrics ("CVSSv3 score" set to 6.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin Feed: 202404171538
Version 1.0 Dec 5, 2023, 6:24 AM New Plugin Feed: 202312050624