PT-2020-6262 · Snmptt+2 · Snmptt+2

Published 2020-08-16 · Updated 2024-03-14 · CVE-2020-24361

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SNMPTT versions prior to 1.4.2

Description The issue is related to incorrect remote user validation in the SNMPTT SNMP-trap handler. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability can be exploited by attackers to execute shell code via EXEC, PREXEC, or unknown trap exec.

Recommendations For SNMPTT versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the EXEC, PREXEC, and unknown trap exec functions to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-273

Related Identifiers

ALT-PU-2020-3129

ALT-PU-2020-3174

ALT-PU-2024-3798

BDU:2021-03734

CVE-2020-24361

DLA-2393-1

Affected Products

Alt Linux

Astra Linux

Snmptt

References · 20

• https://osv.dev/vulnerability/CVE-2020-24361 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24361 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24361 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03734 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-63 · Vendor Advisory
• http://snmptt.org/changelog.shtml · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-24361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24361 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24361 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24361 · Security Note
• https://osv.dev/vulnerability/DLA-2393-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24361 · Vendor Advisory