CVE-2022-24805: debian debian_linux Classic Buffer Overflow

Vulnerability summary

CVE-2022-24805 is a high (CVSS 8.8) Classic Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 69.9% of scored vulnerabilities.

Timeline

1. 16-04-2024
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.