Joined: 12 May 2004
|Posted: Wed Nov 21, 2007 12:26 am Post subject: [ GLSA 200711-31 ] Net-SNMP: Denial of Service
|Gentoo Linux Security Advisory
Title: Net-SNMP: Denial of Service (GLSA 200711-31)
Date: November 20, 2007
A Denial of Service vulnerability has been discovered in Net-SNMP when processing GETBULK requests.
Net-SNMP is a collection of tools for generating and retrieving SNMP data.
Vulnerable: < 5.4.1-r1
Unaffected: >= 5.4.1-r1
Architectures: All supported architectures
The SNMP agent (snmpd) does not properly handle GETBULK requests with an overly large "max-repetitions" field.
A remote unauthenticated attacker could send a specially crafted SNMP request to the vulnerable application, possibly resulting in a high CPU and memory consumption.
There is no known workaround at this time.
All Net-SNMP users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/net-snmp-5.4.1-r1"