CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS
Percentile
98.2%
Net-SNMP is a collection of tools for generating and retrieving SNMP data.
The SNMP agent (snmpd) does not properly handle GETBULK requests with an overly large βmax-repetitionsβ field.
A remote unauthenticated attacker could send a specially crafted SNMP request to the vulnerable application, possibly resulting in a high CPU and memory consumption.
There is no known workaround at this time.
All Net-SNMP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/net-snmp-5.4.1-r1"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | net-analyzer/net-snmp | <Β 5.4.1-r1 | UNKNOWN |