PT-2004-3194 · Ucd · Ucd-Snmp

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2300

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ucd-snmp versions 4.2.6 and earlier

Description: A buffer overflow issue exists in the snmpd component of ucd-snmp, allowing local users to execute arbitrary code via a long command line argument, specifically the -p option, when snmpd is installed setuid root.

Recommendations: For ucd-snmp versions 4.2.6 and earlier, consider removing the setuid root installation of snmpd to prevent exploitation of this issue. If snmpd must be installed setuid root, avoid using long command line arguments, especially with the -p option, until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-2300

Affected Products

Ucd-Snmp

References · 4

• 🔥 http://packetstormsecurity.org/0405-advisories/snmpdadv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2300 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16245 · Note
• http://securityfocus.com/bid/10396 · Note