PT-2019-5733 · Net Snmp+2 · Net-Snmp+2

Published 2019-01-02 · Updated 2022-09-02 · CVE-2019-20892

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions net-snmp versions prior to 5.8.1.pre1

Description The issue is caused by a double free in the usm free usmStateReference function. This can be exploited by a remote attacker using specially crafted GetBulk requests, potentially leading to a denial of service. The problem affects net-snmp packages shipped to end users by multiple Linux distributions.

Recommendations For versions prior to 5.8.1.pre1, update to version 5.8.1.pre1 or later to resolve the issue. As a temporary workaround, consider restricting access to the usm free usmStateReference function in snmplib/snmpusm.c until a patch is available. Avoid using the GetBulk request in the affected API endpoint until the issue is resolved.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2021-01038

CVE-2019-20892

USN-4410-1

Affected Products

Linuxmint

Ubuntu

Net-Snmp

References · 25

• 🔥 http://openwall.com/lists/oss-security/2020/06/25/4 · Exploit
• 🔥 https://sourceforge.net/p/net-snmp/bugs/2923 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1663027 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027 · Exploit
• https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-20892 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-20892 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-20892 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20892 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://osv.dev/vulnerability/CVE-2019-20892 · Vendor Advisory
• https://usn.ubuntu.com/4410-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202008-12 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20892 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20892 · Vendor Advisory