PT-2003-1302 · Ucd+1 · Ucd-Snmp+1

Published 2003-10-30 · Updated 2017-07-11 · CVE-2002-1570

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ucd-snmp version 4.2.3 and earlier net-snmp (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary code via multiple getnextrequest PDU messages with conflicting ifindex variables. This causes the software to write variable data past the end of an array, resulting in a heap-based buffer overflow.

Recommendations For ucd-snmp version 4.2.3 and earlier, update to a version later than 4.2.3 to resolve the issue. For net-snmp, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1570

Affected Products

Net-Snmp

Ucd-Snmp

References · 6

• 🔥 http://securityfocus.com/archive/1/248141 · Exploit
• 🔥 http://securityfocus.com/bid/3780 · Exploit
• 🔥 https://exploit-db.com/exploits/21200 · Exploit
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1570 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7776 · Note