{"id": "SUSE_NET-SNMP-4759.NASL", "bulletinFamily": "scanner", "title": "openSUSE 10 Security Update : net-snmp (net-snmp-4759)", "description": "This update of net-snmp fixes the following bug :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request (CVE-2007-5846)\n\n - crash when smux peers were configured with empty\n passwords", "published": "2008-01-08T00:00:00", "modified": "2008-01-08T00:00:00", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "href": "https://www.tenable.com/plugins/nessus/29883", "reporter": "This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.", "references": [], "cvelist": ["CVE-2007-5846"], "type": "nessus", "lastseen": "2021-01-17T14:46:48", "edition": 24, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-5846"]}, {"type": "f5", "idList": ["F5:K33151296"]}, {"type": "ubuntu", "idList": ["USN-564-1"]}, {"type": "osvdb", "idList": ["OSVDB:38904"]}, {"type": "openvas", "idList": ["OPENVAS:840217", "OPENVAS:65618", "OPENVAS:58761", "OPENVAS:830241", "OPENVAS:60359", "OPENVAS:136141256231065496", "OPENVAS:861593", "OPENVAS:136141256231065618", "OPENVAS:59251", "OPENVAS:1361412562310830241"]}, {"type": "gentoo", "idList": ["GLSA-200711-31"]}, {"type": "centos", "idList": ["CESA-2007:1045"]}, {"type": "freebsd", "idList": ["92F86B93-923F-11DC-A2BF-02E081235DAB"]}, {"type": "debian", "idList": ["DEBIAN:DSA-1483-1:0E1F6"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:8360", "SECURITYVULNS:DOC:18456"]}, {"type": "redhat", "idList": ["RHSA-2007:1045"]}, {"type": "oraclelinux", "idList": ["ELSA-2007-1045"]}, {"type": "seebug", "idList": ["SSV:2401"]}, {"type": "fedora", "idList": ["FEDORA:LAKHRU6R016826", "FEDORA:M5B4OQS6020259"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200711-31.NASL", "REDHAT-RHSA-2007-1045.NASL", "CENTOS_RHSA-2007-1045.NASL", "SUSE9_11999.NASL", "SNMP_GETBULK_MAX_REPETITIONS_DOS.NASL", "SUSE_NET-SNMP-4755.NASL", "SUSE9_12022.NASL", "MANDRAKE_MDKSA-2007-225.NASL", "SUSE_NET-SNMP-4753.NASL", "FEDORA_2007-3019.NASL"]}, {"type": "vmware", "idList": ["VMSA-2008-0007"]}], "modified": "2021-01-17T14:46:48", "rev": 2}, "score": {"value": 7.0, "vector": "NONE", "modified": "2021-01-17T14:46:48", "rev": 2}, "vulnersScore": 7.0}, "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update net-snmp-4759.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(29883);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n\n script_name(english:\"openSUSE 10 Security Update : net-snmp (net-snmp-4759)\");\n script_summary(english:\"Check for the net-snmp-4759 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of net-snmp fixes the following bug :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request (CVE-2007-5846)\n\n - crash when smux peers were configured with empty\n passwords\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected net-snmp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:perl-SNMP\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.1\", reference:\"net-snmp-5.3.0.1-25.22\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"net-snmp-devel-5.3.0.1-25.22\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"perl-SNMP-5.3.0.1-25.22\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp\");\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "29883", "cpe": ["p-cpe:/a:novell:opensuse:perl-SNMP", "p-cpe:/a:novell:opensuse:net-snmp-devel", "p-cpe:/a:novell:opensuse:net-snmp", "cpe:/o:novell:opensuse:10.1"], "scheme": null}

{"cve": [{"lastseen": "2020-12-09T19:26:09", "description": "The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.", "edition": 5, "cvss3": {}, "published": "2007-11-06T21:46:00", "title": "CVE-2007-5846", "type": "cve", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-5846"], "modified": "2018-10-15T21:46:00", "cpe": ["cpe:/a:net-snmp:net-snmp:5.4.1"], "id": "CVE-2007-5846", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5846", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:a:net-snmp:net-snmp:5.4.1:*:*:*:*:*:*:*"]}], "f5": [{"lastseen": "2020-04-06T22:40:48", "bulletinFamily": "software", "cvelist": ["CVE-2007-5846"], "description": "\nF5 Product Development has assigned ID 545965 (ARX) to this vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP AAM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP AFM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP Analytics| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP APM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP ASM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP DNS| None| 13.0.0 \n12.0.0 - 12.1.2| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.2.1| Not vulnerable| None \nBIG-IP GTM| None| 11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP Link Controller| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP PEM| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP PSM| None| 11.4.0 - 11.4.1| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.2.1| Not vulnerable| None \nBIG-IP WebSafe| None| 13.0.0 \n12.0.0 - 12.1.2 \n11.6.0 - 11.6.1| Not vulnerable| None \nARX| 6.2.0 - 6.4.0| None| Medium| net-snmp \nEnterprise Manager| None| 3.1.1| Not vulnerable| None \nBIG-IQ Cloud| None| 4.4.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.4.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.4.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nBIG-IQ Centralized Management| None| 5.0.0 - 5.2.0 \n4.6.0| Not vulnerable| None \nBIG-IQ Cloud and Orchestration| None| 1.0.0| Not vulnerable| None \nF5 iWorkflow| None| 2.0.0 - 2.2.0| Not vulnerable| None \nLineRate| None| 2.5.0 - 2.6.2| Not vulnerable| None \nTraffix SDC| None| 5.0.0 - 5.1.0 \n4.0.0 - 4.4.0| Not vulnerable| None\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K12766: ARX hotfix matrix](<https://support.f5.com/csp/article/K12766>)\n", "edition": 1, "modified": "2018-07-27T22:28:00", "published": "2017-07-22T01:06:00", "id": "F5:K33151296", "href": "https://support.f5.com/csp/article/K33151296", "title": "SNMP vulnerability CVE-2007-5846", "type": "f5", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "ubuntu": [{"lastseen": "2020-07-09T00:22:03", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "Bill Trost discovered that snmpd did not properly limit GETBULK \nrequests. A remote attacker could specify a large number of \nmax-repetitions and cause a denial of service via resource \nexhaustion.", "edition": 5, "modified": "2008-01-09T00:00:00", "published": "2008-01-09T00:00:00", "id": "USN-564-1", "href": "https://ubuntu.com/security/notices/USN-564-1", "title": "Net-SNMP vulnerability", "type": "ubuntu", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:34", "bulletinFamily": "software", "cvelist": ["CVE-2007-5846"], "description": "# No description provided by the source\n\n## References:\nVendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=528095&group_id=12694\nVendor Specific News/Changelog Entry: http://bugs.gentoo.org/show_bug.cgi?id=198346\nVendor Specific News/Changelog Entry: http://sourceforge.net/tracker/index.php?func=detail&aid=1712988&group_id=12694&atid=112694\nSecurity Tracker: 1018918\n[Secunia Advisory ID:27558](https://secuniaresearch.flexerasoftware.com/advisories/27558/)\n[Secunia Advisory ID:27965](https://secuniaresearch.flexerasoftware.com/advisories/27965/)\n[Secunia Advisory ID:27733](https://secuniaresearch.flexerasoftware.com/advisories/27733/)\n[Secunia Advisory ID:27740](https://secuniaresearch.flexerasoftware.com/advisories/27740/)\n[Secunia Advisory ID:27689](https://secuniaresearch.flexerasoftware.com/advisories/27689/)\n[Secunia Advisory ID:27685](https://secuniaresearch.flexerasoftware.com/advisories/27685/)\n[Secunia Advisory ID:28413](https://secuniaresearch.flexerasoftware.com/advisories/28413/)\nRedHat RHSA: RHSA-2007:1045\nOther Advisory URL: http://sourceforge.net/tracker/index.php?func=detail&aid=1712988&group_id=12694&atid=112694\nOther Advisory URL: http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-4-1/net-snmp/agent/snmp_agent.c?view=log\nOther Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200711-31.xml\nOther Advisory URL: http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:225\nOther Advisory URL: https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00613.html\nOther Advisory URL: http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00002.html\nOther Advisory URL: http://www.ubuntu.com/usn/usn-564-1\nFrSIRT Advisory: ADV-2007-3802\n[CVE-2007-5846](https://vulners.com/cve/CVE-2007-5846)\nBugtraq ID: 26378\n", "edition": 1, "modified": "2007-05-04T00:00:00", "published": "2007-05-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:38904", "id": "OSVDB:38904", "title": "net-snmp snmp_agent.c Malformed GETBULK Request Remote Memory Consumption DoS", "type": "osvdb", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "openvas": [{"lastseen": "2017-12-04T11:28:10", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "Ubuntu Update for Linux kernel vulnerabilities USN-564-1", "modified": "2017-12-01T00:00:00", "published": "2009-03-23T00:00:00", "id": "OPENVAS:840217", "href": "http://plugins.openvas.org/nasl.php?oid=840217", "type": "openvas", "title": "Ubuntu Update for net-snmp vulnerability USN-564-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_564_1.nasl 7969 2017-12-01 09:23:16Z santu $\n#\n# Ubuntu Update for net-snmp vulnerability USN-564-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Bill Trost discovered that snmpd did not properly limit GETBULK\n requests. A remote attacker could specify a large number of\n max-repetitions and cause a denial of service via resource\n exhaustion.\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-564-1\";\ntag_affected = \"net-snmp vulnerability on Ubuntu 6.06 LTS ,\n Ubuntu 6.10 ,\n Ubuntu 7.04 ,\n Ubuntu 7.10\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-564-1/\");\n script_id(840217);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-23 10:59:50 +0100 (Mon, 23 Mar 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name: \"USN\", value: \"564-1\");\n script_cve_id(\"CVE-2007-5846\");\n script_name( \"Ubuntu Update for net-snmp vulnerability USN-564-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU7.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-perl\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9-dev\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmp\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmpd\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-base\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"tkmib\", ver:\"5.2.3-4ubuntu1.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.06 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-perl\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9-dev\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmp\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmpd\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-base\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"tkmib\", ver:\"5.2.1.2-4ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-perl\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9-dev\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp9\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmp\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmpd\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-base\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"tkmib\", ver:\"5.2.2-5ubuntu1.1\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU7.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-dev\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-perl\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp10\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmp\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"snmpd\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libsnmp-base\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"tkmib\", ver:\"5.3.1-6ubuntu2.1\", rls:\"UBUNTU7.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5017417 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "modified": "2018-04-06T00:00:00", "published": "2009-10-10T00:00:00", "id": "OPENVAS:136141256231065618", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065618", "type": "openvas", "title": "SLES9: Security update for net-snmp", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5017417.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Security update for net-snmp\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5017417 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65618\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"SLES9: Security update for net-snmp\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.1.3.1~0.17.2\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-04-09T11:41:23", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "Check for the Version of net-snmp", "modified": "2018-04-06T00:00:00", "published": "2009-04-09T00:00:00", "id": "OPENVAS:1361412562310830241", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830241", "type": "openvas", "title": "Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to\n cause a denial of service (CPU and memory consumption) via a GETBULK\n request with a large max-repeaters value.\n\n Updated packages fix this issue.\";\n\ntag_affected = \"net-snmp on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-11/msg00033.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830241\");\n script_version(\"$Revision: 9370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:53:14 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:00:25 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name: \"MDKSA\", value: \"2007:225\");\n script_cve_id(\"CVE-2007-5846\");\n script_name( \"Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)\");\n\n script_tag(name:\"summary\", value:\"Check for the Version of net-snmp\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10\", rpm:\"libnet-snmp10~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-devel\", rpm:\"libnet-snmp10-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-static-devel\", rpm:\"libnet-snmp10-static-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-mibs\", rpm:\"net-snmp-mibs~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-trapd\", rpm:\"net-snmp-trapd~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-NetSNMP\", rpm:\"perl-NetSNMP~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10\", rpm:\"lib64net-snmp10~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-devel\", rpm:\"lib64net-snmp10-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-static-devel\", rpm:\"lib64net-snmp10-static-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10\", rpm:\"libnet-snmp10~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-devel\", rpm:\"libnet-snmp10-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-static-devel\", rpm:\"libnet-snmp10-static-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-mibs\", rpm:\"net-snmp-mibs~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-trapd\", rpm:\"net-snmp-trapd~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-NetSNMP\", rpm:\"perl-NetSNMP~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10\", rpm:\"lib64net-snmp10~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-devel\", rpm:\"lib64net-snmp10-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-static-devel\", rpm:\"lib64net-snmp10-static-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing updates announced in\nadvisory GLSA 200711-31.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "id": "OPENVAS:59251", "href": "http://plugins.openvas.org/nasl.php?oid=59251", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200711-31 (net-snmp)", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A Denial of Service vulnerability has been discovered in Net-SNMP when\nprocessing GETBULK requests.\";\ntag_solution = \"All Net-SNMP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-analyzer/net-snmp-5.4.1-r1'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200711-31\nhttp://bugs.gentoo.org/show_bug.cgi?id=198346\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200711-31.\";\n\n \n\nif(description)\n{\n script_id(59251);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200711-31 (net-snmp)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-analyzer/net-snmp\", unaffected: make_list(\"ge 5.4.1-r1\"), vulnerable: make_list(\"lt 5.4.1-r1\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-02T21:10:25", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-26T00:00:00", "published": "2008-09-04T00:00:00", "id": "OPENVAS:58761", "href": "http://plugins.openvas.org/nasl.php?oid=58761", "type": "openvas", "title": "FreeBSD Ports: net-snmp", "sourceData": "#\n#VID 92f86b93-923f-11dc-a2bf-02e081235dab\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: net-snmp\n\n=====\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\";\nif(description)\n{\n script_id(58761);\n script_version(\"$Revision: 4144 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-26 07:28:56 +0200 (Mon, 26 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"FreeBSD Ports: net-snmp\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"net-snmp\");\nif(!isnull(bver) && revcomp(a:bver, b:\"5.3.1_7\")<0) {\n txt += 'Package net-snmp version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing an update to net-snmp\nannounced via advisory DSA 1483-1.", "modified": "2017-07-07T00:00:00", "published": "2008-02-15T00:00:00", "id": "OPENVAS:60359", "href": "http://plugins.openvas.org/nasl.php?oid=60359", "type": "openvas", "title": "Debian Security Advisory DSA 1483-1 (net-snmp)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1483_1.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 1483-1 (net-snmp)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote\nattackers to cause a denial of service (CPU and memory consumption)\nvia a GETBULK request with a large max-repeaters value.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.2.3-7etch2\n\nFor the unstable and testing distributions (sid and lenny,\nrespectively), this problem has been fixed in version 5.4.1~dfsg-2\n\nWe recommend that you upgrade your net-snmp package.\";\ntag_summary = \"The remote host is missing an update to net-snmp\nannounced via advisory DSA 1483-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201483-1\";\n\n\nif(description)\n{\n script_id(60359);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-02-15 23:29:21 +0100 (Fri, 15 Feb 2008)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Debian Security Advisory DSA 1483-1 (net-snmp)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"tkmib\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libsnmp-base\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"snmpd\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"snmp\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libsnmp9\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libsnmp9-dev\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libsnmp-perl\", ver:\"5.2.3-7etch2\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:56:13", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "Check for the Version of net-snmp", "modified": "2017-07-10T00:00:00", "published": "2009-02-27T00:00:00", "id": "OPENVAS:861593", "href": "http://plugins.openvas.org/nasl.php?oid=861593", "type": "openvas", "title": "Fedora Update for net-snmp FEDORA-2007-3019", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for net-snmp FEDORA-2007-3019\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"SNMP (Simple Network Management Protocol) is a protocol used for\n network management. The NET-SNMP project includes various SNMP tools:\n an extensible agent, an SNMP library, tools for requesting or setting\n information from SNMP agents, tools for generating and handling SNMP\n traps, a version of the netstat command which uses SNMP, and a Tk/Perl\n mib browser. This package contains the snmpd and snmptrapd daemons,\n documentation, etc.\n\n You will probably also want to install the net-snmp-utils package,\n which contains NET-SNMP utilities.\n \n Building option:\n \t--without tcp_wrappers : disable tcp_wrappers support\";\n\ntag_affected = \"net-snmp on Fedora 7\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00613.html\");\n script_id(861593);\n script_version(\"$Revision: 6623 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:10:20 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-27 16:23:18 +0100 (Fri, 27 Feb 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name: \"FEDORA\", value: \"2007-3019\");\n script_cve_id(\"CVE-2007-5846\");\n script_name( \"Fedora Update for net-snmp FEDORA-2007-3019\");\n\n script_summary(\"Check for the Version of net-snmp\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC7\")\n{\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-perl\", rpm:\"net-snmp-perl~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-devel\", rpm:\"net-snmp-devel~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-debuginfo\", rpm:\"net-snmp-debuginfo~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-libs\", rpm:\"net-snmp-libs~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-libs\", rpm:\"net-snmp-libs~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-perl\", rpm:\"net-snmp-perl~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-devel\", rpm:\"net-snmp-devel~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-debuginfo\", rpm:\"net-snmp-debuginfo~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.4~16.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:17", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5010225 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "modified": "2018-04-06T00:00:00", "published": "2009-10-10T00:00:00", "id": "OPENVAS:136141256231065496", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065496", "type": "openvas", "title": "SLES9: Security update for net-snmp", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5010225.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Security update for net-snmp\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5010225 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65496\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"SLES9: Security update for net-snmp\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.1.3.1~0.20\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-26T08:55:27", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5017417 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "modified": "2017-07-11T00:00:00", "published": "2009-10-10T00:00:00", "id": "OPENVAS:65618", "href": "http://plugins.openvas.org/nasl.php?oid=65618", "type": "openvas", "title": "SLES9: Security update for net-snmp", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5017417.nasl 6666 2017-07-11 13:13:36Z cfischer $\n# Description: Security update for net-snmp\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n net-snmp\n perl-SNMP\n net-snmp-devel\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5017417 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65618);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2007-5846\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"SLES9: Security update for net-snmp\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.1.3.1~0.17.2\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:05", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "description": "Check for the Version of net-snmp", "modified": "2017-07-06T00:00:00", "published": "2009-04-09T00:00:00", "id": "OPENVAS:830241", "href": "http://plugins.openvas.org/nasl.php?oid=830241", "type": "openvas", "title": "Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to\n cause a denial of service (CPU and memory consumption) via a GETBULK\n request with a large max-repeaters value.\n\n Updated packages fix this issue.\";\n\ntag_affected = \"net-snmp on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-11/msg00033.php\");\n script_id(830241);\n script_version(\"$Revision: 6568 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:04:21 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:00:25 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_xref(name: \"MDKSA\", value: \"2007:225\");\n script_cve_id(\"CVE-2007-5846\");\n script_name( \"Mandriva Update for net-snmp MDKSA-2007:225 (net-snmp)\");\n\n script_summary(\"Check for the Version of net-snmp\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10\", rpm:\"libnet-snmp10~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-devel\", rpm:\"libnet-snmp10-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-static-devel\", rpm:\"libnet-snmp10-static-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-mibs\", rpm:\"net-snmp-mibs~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-trapd\", rpm:\"net-snmp-trapd~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-NetSNMP\", rpm:\"perl-NetSNMP~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10\", rpm:\"lib64net-snmp10~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-devel\", rpm:\"lib64net-snmp10-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-static-devel\", rpm:\"lib64net-snmp10-static-devel~5.3.1~3.1mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10\", rpm:\"libnet-snmp10~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-devel\", rpm:\"libnet-snmp10-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libnet-snmp10-static-devel\", rpm:\"libnet-snmp10-static-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp\", rpm:\"net-snmp~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-mibs\", rpm:\"net-snmp-mibs~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-trapd\", rpm:\"net-snmp-trapd~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"net-snmp-utils\", rpm:\"net-snmp-utils~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"perl-NetSNMP\", rpm:\"perl-NetSNMP~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10\", rpm:\"lib64net-snmp10~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-devel\", rpm:\"lib64net-snmp10-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64net-snmp10-static-devel\", rpm:\"lib64net-snmp10-static-devel~5.3.1~2.1mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:47:00", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "### Background\n\nNet-SNMP is a collection of tools for generating and retrieving SNMP data. \n\n### Description\n\nThe SNMP agent (snmpd) does not properly handle GETBULK requests with an overly large \"max-repetitions\" field. \n\n### Impact\n\nA remote unauthenticated attacker could send a specially crafted SNMP request to the vulnerable application, possibly resulting in a high CPU and memory consumption. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Net-SNMP users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-analyzer/net-snmp-5.4.1-r1\"", "edition": 1, "modified": "2007-11-20T00:00:00", "published": "2007-11-20T00:00:00", "id": "GLSA-200711-31", "href": "https://security.gentoo.org/glsa/200711-31", "type": "gentoo", "title": "Net-SNMP: Denial of Service", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "centos": [{"lastseen": "2019-12-20T18:25:21", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "**CentOS Errata and Security Advisory** CESA-2007:1045\n\n\nSimple Network Management Protocol (SNMP) is a protocol used for network\r\nmanagement.\r\n\r\nA flaw was discovered in the way net-snmp handled certain requests. A\r\nremote attacker who can connect to the snmpd UDP port (161 by default)\r\ncould send a malicious packet causing snmpd to crash, resulting in a\r\ndenial of service. (CVE-2007-5846)\r\n\r\nAll users of net-snmp are advised to upgrade to these updated packages,\r\nwhich contain a backported patch to resolve this issue.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026471.html\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026477.html\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026478.html\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026481.html\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026490.html\nhttp://lists.centos.org/pipermail/centos-announce/2007-November/026491.html\n\n**Affected packages:**\nnet-snmp\nnet-snmp-devel\nnet-snmp-libs\nnet-snmp-perl\nnet-snmp-utils\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2007-1045.html", "edition": 4, "modified": "2007-11-16T18:42:22", "published": "2007-11-15T19:23:48", "href": "http://lists.centos.org/pipermail/centos-announce/2007-November/026471.html", "id": "CESA-2007:1045", "title": "net security update", "type": "centos", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "freebsd": [{"lastseen": "2019-05-29T18:34:30", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "\nCVE reports:\n\nThe SNMP agent (snmp_agent.c) in net-snmp before 5.4.1\n\t allows remote attackers to cause a denial of service (CPU\n\t and memory consumption) via a GETBULK request with a large\n\t max-repeaters value.\n\n", "edition": 4, "modified": "2007-11-14T00:00:00", "published": "2007-11-06T00:00:00", "id": "92F86B93-923F-11DC-A2BF-02E081235DAB", "href": "https://vuxml.freebsd.org/freebsd/92f86b93-923f-11dc-a2bf-02e081235dab.html", "title": "net-snmp -- denial of service via GETBULK request", "type": "freebsd", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "debian": [{"lastseen": "2020-11-11T13:28:28", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1483-1 security@debian.org\nhttp://www.debian.org/security/ Noah Meyerhans\nFebruary 06, 2008 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : net-snmp\nVulnerability : design error\nProblem type : remote\nDebian-specific: no\nCVE Id(s) : CVE-2007-5846\n\nThe SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote\nattackers to cause a denial of service (CPU and memory consumption)\nvia a GETBULK request with a large max-repeaters value.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.2.3-7etch2\n\nFor the unstable and testing distributions (sid and lenny,\nrespectively), this problem has been fixed in version 5.4.1~dfsg-2\n\nWe recommend that you upgrade your net-snmp package.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nStable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/n/net-snmp/net-snmp_5.2.3-7etch2.diff.gz\n Size/MD5 checksum: 92129 d4395b24ac55a351ff666b146e50e7da\n http://security.debian.org/pool/updates/main/n/net-snmp/net-snmp_5.2.3-7etch2.dsc\n Size/MD5 checksum: 1038 34169ea344d11cc6acbbc79598f1afbe\n http://security.debian.org/pool/updates/main/n/net-snmp/net-snmp_5.2.3.orig.tar.gz\n Size/MD5 checksum: 4006389 ba4bc583413f90618228d0f196da8181\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/n/net-snmp/tkmib_5.2.3-7etch2_all.deb\n Size/MD5 checksum: 855026 9ba19bd7e95b8b786db833d088033c20\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-base_5.2.3-7etch2_all.deb\n Size/MD5 checksum: 1215052 492929e419a21cb45a6b9f7f892e51e5\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_alpha.deb\n Size/MD5 checksum: 836522 8f375e58599f11a92c219432c3c40a50\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_alpha.deb\n Size/MD5 checksum: 942474 877cd68b94cc98c3ce277f81e94ad559\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_alpha.deb\n Size/MD5 checksum: 1901930 4ce94285480f0587b9c9006db0b1d892\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_alpha.deb\n Size/MD5 checksum: 2171130 b21a6b7ab1fc2084134b0746c46caaa8\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_alpha.deb\n Size/MD5 checksum: 932262 eb96a420dd3fb6b556ed8001bc44bb93\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_amd64.deb\n Size/MD5 checksum: 1892588 eed6e7f494feeb82dadfd6292aeb54f3\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_amd64.deb\n Size/MD5 checksum: 834892 1870924c9276f277d5e61b6929bc063a\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_amd64.deb\n Size/MD5 checksum: 931080 f413808b39167a15c6d1452767537e36\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_amd64.deb\n Size/MD5 checksum: 1561022 29910b7b991cc876540f926ee5e2453a\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_amd64.deb\n Size/MD5 checksum: 919590 0962031c17b2cc752b2aa0a34224face\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_arm.deb\n Size/MD5 checksum: 1777992 b7bb0164b520a6240321efdafbde344b\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_arm.deb\n Size/MD5 checksum: 834966 473f0c386f9c6da35689b14ab1d379c1\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_arm.deb\n Size/MD5 checksum: 1344096 153ff9028f6accc63ed18d7bdf07485b\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_arm.deb\n Size/MD5 checksum: 927916 989b6de8d07d36bd144ca88423b8d027\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_arm.deb\n Size/MD5 checksum: 909516 6d3f6fd8e7472228f20c60be890d023e\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_i386.deb\n Size/MD5 checksum: 834156 8166a1a4c4f97fbe40efbf491b7bf72c\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_i386.deb\n Size/MD5 checksum: 917354 b894368213ab2cd00eded49533b16aa6\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_i386.deb\n Size/MD5 checksum: 1835912 c7567cd3db0d4e6536a3002eb4d8e265\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_i386.deb\n Size/MD5 checksum: 924832 ba03a9804f155ea4a284f7643457b146\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_i386.deb\n Size/MD5 checksum: 1416974 619e4f9b2c3eb7819cd2bd524ca7554b\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_ia64.deb\n Size/MD5 checksum: 970124 3deb315b5de9afb14b52b394bae18a43\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_ia64.deb\n Size/MD5 checksum: 962568 4c5698e042bf664eff0bfe993c192d5d\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_ia64.deb\n Size/MD5 checksum: 2281236 d4bc4f69d7e7a593335053e91a6c485d\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_ia64.deb\n Size/MD5 checksum: 842400 a950588e1b8e71079343ecd47e2d640f\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_ia64.deb\n Size/MD5 checksum: 2205332 702c89982dfae8501a048367d78161a8\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_mips.deb\n Size/MD5 checksum: 927142 5c8a6c536a3d50fd5002e12f62872224\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_mips.deb\n Size/MD5 checksum: 895056 4cbf2439096d64f153e94c2d45021310\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_mips.deb\n Size/MD5 checksum: 1717040 6d61c1ac4c4a67b69ca4d59244f4eefa\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_mips.deb\n Size/MD5 checksum: 1769510 0b2fb829d8c98099a21fe59375eaab6f\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_mips.deb\n Size/MD5 checksum: 832874 b55a90b9778923425fd4ede1403a1483\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_mipsel.deb\n Size/MD5 checksum: 1720352 83b11573a1389090c6419974438810a6\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_mipsel.deb\n Size/MD5 checksum: 894848 a85af9050de7d658d06beb78cfd331d4\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_mipsel.deb\n Size/MD5 checksum: 1755240 edbf171acb4813d6e8936f553b0c63bf\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_mipsel.deb\n Size/MD5 checksum: 832830 47e00fa0d4acad4a9adcbeab7f34a33d\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_mipsel.deb\n Size/MD5 checksum: 926346 9d81f235f0232259ac87af5d9a77a3f2\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_powerpc.deb\n Size/MD5 checksum: 941140 e45bfb918d4814fc58509576cb353855\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_powerpc.deb\n Size/MD5 checksum: 1657898 67553ac67857e5a93610fcb62a114faa\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_powerpc.deb\n Size/MD5 checksum: 927732 1c6e3bc8b903ed51301d55e5329121f0\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_powerpc.deb\n Size/MD5 checksum: 1802946 54dfa2f2746fe644f7129499eb709284\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_powerpc.deb\n Size/MD5 checksum: 834926 c63610793fa21e534247fb4eebfcdf38\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_s390.deb\n Size/MD5 checksum: 903456 0a741302e5532e07949911f755522f47\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_s390.deb\n Size/MD5 checksum: 835824 d3bae80f1bbf09eade1207b758945003\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_s390.deb\n Size/MD5 checksum: 1834732 cc3acadd0669ee790c77e141e73d951b\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_s390.deb\n Size/MD5 checksum: 1409706 594dae3b8a0d801bc5aa0cbe240785fc\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_s390.deb\n Size/MD5 checksum: 931154 08a5a95841d6c643660dfe8df647d9f1\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp-perl_5.2.3-7etch2_sparc.deb\n Size/MD5 checksum: 918174 d0f688bfabae071b11d24b852e90c11b\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9_5.2.3-7etch2_sparc.deb\n Size/MD5 checksum: 1781666 ab7507949d9f8f111e530f3e0aa42e42\n http://security.debian.org/pool/updates/main/n/net-snmp/snmp_5.2.3-7etch2_sparc.deb\n Size/MD5 checksum: 925014 b6df8efcb3e971cb711e37f4b4d21302\n http://security.debian.org/pool/updates/main/n/net-snmp/snmpd_5.2.3-7etch2_sparc.deb\n Size/MD5 checksum: 833856 f13884fa38c2eb1fe055e044503f3e67\n http://security.debian.org/pool/updates/main/n/net-snmp/libsnmp9-dev_5.2.3-7etch2_sparc.deb\n Size/MD5 checksum: 1548582 426a31f689fb0b3b3f4777a7e6bb51db\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n", "edition": 7, "modified": "2008-02-06T19:14:31", "published": "2008-02-06T19:14:31", "id": "DEBIAN:DSA-1483-1:0E1F6", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2008/msg00046.html", "title": "[SECURITY] [DSA 1483-1] New net-snmp packages fix denial of service vulnerability", "type": "debian", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:27", "bulletinFamily": "software", "cvelist": ["CVE-2007-5846"], "description": "CPU resources exhaustion on GETBULK with large max-repeaters parameter value.", "edition": 1, "modified": "2007-11-19T00:00:00", "published": "2007-11-19T00:00:00", "id": "SECURITYVULNS:VULN:8360", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8360", "title": "net-snmp DoS", "type": "securityvulns", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:24", "bulletinFamily": "software", "cvelist": ["CVE-2007-5846"], "description": "\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n \r\n Mandriva Linux Security Advisory MDKSA-2007:225\r\n http://www.mandriva.com/security/\r\n _______________________________________________________________________\r\n \r\n Package : net-snmp\r\n Date : November 19, 2007\r\n Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,\r\n Multi Network Firewall 2.0\r\n _______________________________________________________________________\r\n \r\n Problem Description:\r\n \r\n The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers to\r\n cause a denial of service &#40;CPU and memory consumption&#41; via a GETBULK\r\n request with a large max-repeaters value.\r\n \r\n Updated packages fix this issue.\r\n _______________________________________________________________________\r\n\r\n References:\r\n \r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846\r\n _______________________________________________________________________\r\n \r\n Updated Packages:\r\n \r\n Mandriva Linux 2007.0:\r\n 83e0d0edc66af5d11b032cf2a7c12054 2007.0/i586/libnet-snmp10-5.3.1-2.1mdv2007.0.i586.rpm\r\n 211db38ffbbefb22f653a18da8e928f5 2007.0/i586/libnet-snmp10-devel-5.3.1-2.1mdv2007.0.i586.rpm\r\n b43cc33ca2b0fb582e69bbe52578e76a 2007.0/i586/libnet-snmp10-static-devel-5.3.1-2.1mdv2007.0.i586.rpm\r\n e2ac837cd1eff29bb56f5fa964f59ed5 2007.0/i586/net-snmp-5.3.1-2.1mdv2007.0.i586.rpm\r\n 2434602e5d0a3133318600b4071cf4ea 2007.0/i586/net-snmp-mibs-5.3.1-2.1mdv2007.0.i586.rpm\r\n d9336d2710c1a44531cdb790cd8f47cf 2007.0/i586/net-snmp-trapd-5.3.1-2.1mdv2007.0.i586.rpm\r\n a1945889589568b420181a8a196d51ad 2007.0/i586/net-snmp-utils-5.3.1-2.1mdv2007.0.i586.rpm\r\n cf8fd2357e80a805ab3210fd3a8f8d01 2007.0/i586/perl-NetSNMP-5.3.1-2.1mdv2007.0.i586.rpm \r\n da66327183a153d054bbc5d70fde958c 2007.0/SRPMS/net-snmp-5.3.1-2.1mdv2007.0.src.rpm\r\n\r\n Mandriva Linux 2007.0/X86_64:\r\n 7a4a25157d9a1e3b9cf4bf7af1205aa8 2007.0/x86_64/lib64net-snmp10-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n cab6a3e8bc7167656e38e5a429eb8c0a 2007.0/x86_64/lib64net-snmp10-devel-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n 03f09f4fe99c381bda2603861f9644a2 2007.0/x86_64/lib64net-snmp10-static-devel-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n 425489fcb707757a46e0c6105309e2ff 2007.0/x86_64/net-snmp-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n 7df1fa9a564c63687621355561ba9eec 2007.0/x86_64/net-snmp-mibs-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n fe2aaae5507ae5122a7d30f9fd74eef5 2007.0/x86_64/net-snmp-trapd-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n ee1ae1d56af4b511b3bb2b1a986aa60a 2007.0/x86_64/net-snmp-utils-5.3.1-2.1mdv2007.0.x86_64.rpm\r\n 04393ea88742f3b05586a555d8ad81ec 2007.0/x86_64/perl-NetSNMP-5.3.1-2.1mdv2007.0.x86_64.rpm \r\n da66327183a153d054bbc5d70fde958c 2007.0/SRPMS/net-snmp-5.3.1-2.1mdv2007.0.src.rpm\r\n\r\n Mandriva Linux 2007.1:\r\n fa0f200cd711f97684d9debfdeef3e15 2007.1/i586/libnet-snmp10-5.3.1-3.1mdv2007.1.i586.rpm\r\n 68c25bedfd4370a5fc0aa5ff934a2b1b 2007.1/i586/libnet-snmp10-devel-5.3.1-3.1mdv2007.1.i586.rpm\r\n ecbd2c76a1ea3595594f10c66bea5772 2007.1/i586/libnet-snmp10-static-devel-5.3.1-3.1mdv2007.1.i586.rpm\r\n 04c676ae1290bbfbd7083252ae5b10dd 2007.1/i586/net-snmp-5.3.1-3.1mdv2007.1.i586.rpm\r\n 2a6c6befd5958c7c9c946d2189d2f128 2007.1/i586/net-snmp-mibs-5.3.1-3.1mdv2007.1.i586.rpm\r\n 5cd1e27c1af30157ead213324c440527 2007.1/i586/net-snmp-trapd-5.3.1-3.1mdv2007.1.i586.rpm\r\n 423682a7f455940da49272647925838e 2007.1/i586/net-snmp-utils-5.3.1-3.1mdv2007.1.i586.rpm\r\n 1ca18897188b7a34d98b146d65746477 2007.1/i586/perl-NetSNMP-5.3.1-3.1mdv2007.1.i586.rpm \r\n f2a3a8df265da917384a4c0916b330a6 2007.1/SRPMS/net-snmp-5.3.1-3.1mdv2007.1.src.rpm\r\n\r\n Mandriva Linux 2007.1/X86_64:\r\n 9cdea571a84945accd6d38527b1bedb5 2007.1/x86_64/lib64net-snmp10-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n 8352cb8ef1fac035ea009d696e1d5837 2007.1/x86_64/lib64net-snmp10-devel-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n 5e54dd10e2f97bd2ee23f0a715ef734e 2007.1/x86_64/lib64net-snmp10-static-devel-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n 3187463725a5b015d3f507ac4a723160 2007.1/x86_64/net-snmp-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n 638d8c0a5d4be46ee1b9c2640ed7a061 2007.1/x86_64/net-snmp-mibs-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n c4f41ebf9bf64dfc5236bb935ee16c31 2007.1/x86_64/net-snmp-trapd-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n 734133a9a7a860f90b76c8bd72a0ddd0 2007.1/x86_64/net-snmp-utils-5.3.1-3.1mdv2007.1.x86_64.rpm\r\n b1f5da81f1c27888df5ba8f71279fb05 2007.1/x86_64/perl-NetSNMP-5.3.1-3.1mdv2007.1.x86_64.rpm \r\n f2a3a8df265da917384a4c0916b330a6 2007.1/SRPMS/net-snmp-5.3.1-3.1mdv2007.1.src.rpm\r\n\r\n Corporate 3.0:\r\n 748009feee8a9d4d904b7e77537ff791 corporate/3.0/i586/libnet-snmp5-5.1-7.3.C30mdk.i586.rpm\r\n 8ca0b75c8ec8e0839ae37335b04629ab corporate/3.0/i586/libnet-snmp5-devel-5.1-7.3.C30mdk.i586.rpm\r\n a0c2d416faa87c016826b5f8616c3af3 corporate/3.0/i586/libnet-snmp5-static-devel-5.1-7.3.C30mdk.i586.rpm\r\n 99659604d3f40d23179b2b3138178e41 corporate/3.0/i586/net-snmp-5.1-7.3.C30mdk.i586.rpm\r\n 3f9e8c99d31dd0dd0d3e5364325370ac corporate/3.0/i586/net-snmp-mibs-5.1-7.3.C30mdk.i586.rpm\r\n 6bf842fa5664b91062fc74fac450aa90 corporate/3.0/i586/net-snmp-trapd-5.1-7.3.C30mdk.i586.rpm\r\n ced36508ad4a349cf945d62823b556d5 corporate/3.0/i586/net-snmp-utils-5.1-7.3.C30mdk.i586.rpm \r\n d8da239034cf799078cc3df5c5646501 corporate/3.0/SRPMS/net-snmp-5.1-7.3.C30mdk.src.rpm\r\n\r\n Corporate 3.0/X86_64:\r\n d3f097f7389841deb188d7353c5fdf5c corporate/3.0/x86_64/lib64net-snmp5-5.1-7.3.C30mdk.x86_64.rpm\r\n b53aea1a27f1c5a1e5515abb31ac70b0 corporate/3.0/x86_64/lib64net-snmp5-devel-5.1-7.3.C30mdk.x86_64.rpm\r\n a910dfbb95c2dd8fe70ce1c62e743c03 corporate/3.0/x86_64/lib64net-snmp5-static-devel-5.1-7.3.C30mdk.x86_64.rpm\r\n bfe1ba7a83f9afcacd9273eb6ebbd538 corporate/3.0/x86_64/net-snmp-5.1-7.3.C30mdk.x86_64.rpm\r\n b6e7b70f0d7549f44850834b2542fb8f corporate/3.0/x86_64/net-snmp-mibs-5.1-7.3.C30mdk.x86_64.rpm\r\n a5ab3548c27e86789e41248ab53e4982 corporate/3.0/x86_64/net-snmp-trapd-5.1-7.3.C30mdk.x86_64.rpm\r\n 3c57bfdfa6b4ac44adab12bda0131a2f corporate/3.0/x86_64/net-snmp-utils-5.1-7.3.C30mdk.x86_64.rpm \r\n d8da239034cf799078cc3df5c5646501 corporate/3.0/SRPMS/net-snmp-5.1-7.3.C30mdk.src.rpm\r\n\r\n Corporate 4.0:\r\n 0fac46c024f1cb4a8be101e69a942233 corporate/4.0/i586/libnet-snmp5-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n 857fcac472ce931834cccde0de2741e4 corporate/4.0/i586/libnet-snmp5-devel-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n 112cceb5d76947959c251ecb1b157a3e corporate/4.0/i586/libnet-snmp5-static-devel-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n ecf0b6386447f6442375cb39c60479cd corporate/4.0/i586/net-snmp-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n 72a4fa1c8af3cc00bfbb3d877d5c329a corporate/4.0/i586/net-snmp-mibs-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n ab9ceaa6d9df42f687fe0c6790a2d266 corporate/4.0/i586/net-snmp-trapd-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n c66e13b576028690583f0fa2318bee3f corporate/4.0/i586/net-snmp-utils-5.2.1.2-5.1.20060mlcs4.i586.rpm\r\n 8aeab0a22ec99e5cde40593c883415aa corporate/4.0/i586/perl-NetSNMP-5.2.1.2-5.1.20060mlcs4.i586.rpm \r\n b42c3b00b13c6cc458a0435dd4c7ff71 corporate/4.0/SRPMS/net-snmp-5.2.1.2-5.1.20060mlcs4.src.rpm\r\n\r\n Corporate 4.0/X86_64:\r\n 3bb05138c10885baa4db145f2ae6c726 corporate/4.0/x86_64/lib64net-snmp5-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n 2ef53cc96353eefb27abf76bc83bd35f corporate/4.0/x86_64/lib64net-snmp5-devel-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n 14ce1bda23212a415cbdcc43b46813c2 corporate/4.0/x86_64/lib64net-snmp5-static-devel-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n f6e393154ee66701b8fb5d848aeb3d7e corporate/4.0/x86_64/net-snmp-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n 77fcaeda03c9bed289ba9a7a6cc1ca48 corporate/4.0/x86_64/net-snmp-mibs-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n e40ea44f385c0c92961fb11fa4013c02 corporate/4.0/x86_64/net-snmp-trapd-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n 537f8597086053c4d5a56ebd7d35b9e3 corporate/4.0/x86_64/net-snmp-utils-5.2.1.2-5.1.20060mlcs4.x86_64.rpm\r\n 51b4c70346529ba7a88de89543d16040 corporate/4.0/x86_64/perl-NetSNMP-5.2.1.2-5.1.20060mlcs4.x86_64.rpm \r\n b42c3b00b13c6cc458a0435dd4c7ff71 corporate/4.0/SRPMS/net-snmp-5.2.1.2-5.1.20060mlcs4.src.rpm\r\n\r\n Multi Network Firewall 2.0:\r\n 9210aef172a538942f490c89afb4022b mnf/2.0/i586/libnet-snmp5-5.1-7.3.M20mdk.i586.rpm \r\n 844c7d5cb0cec99e3cab16792cb7766e mnf/2.0/SRPMS/net-snmp-5.1-7.3.M20mdk.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/security/advisories\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_&#40;at&#41;_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n &lt;security*mandriva.com&gt;\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.7 &#40;GNU/Linux&#41;\r\n\r\niD8DBQFHQaYcmqjQ0CJFipgRAtwPAKDBmKLrILjPOlBxv0HLu3YwQxbjFACfVRZM\r\n+tyjwf62Xh9rba65JnJ1RtU=\r\n=zmEd\r\n-----END PGP SIGNATURE-----", "edition": 1, "modified": "2007-11-19T00:00:00", "published": "2007-11-19T00:00:00", "id": "SECURITYVULNS:DOC:18456", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:18456", "title": "[ MDKSA-2007:225 ] - Updated net-snmp packages fix remote denial of service vulnerability", "type": "securityvulns", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2019-08-13T18:46:07", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "Simple Network Management Protocol (SNMP) is a protocol used for network\r\nmanagement.\r\n\r\nA flaw was discovered in the way net-snmp handled certain requests. A\r\nremote attacker who can connect to the snmpd UDP port (161 by default)\r\ncould send a malicious packet causing snmpd to crash, resulting in a\r\ndenial of service. (CVE-2007-5846)\r\n\r\nAll users of net-snmp are advised to upgrade to these updated packages,\r\nwhich contain a backported patch to resolve this issue.", "modified": "2017-09-08T12:10:57", "published": "2007-11-15T05:00:00", "id": "RHSA-2007:1045", "href": "https://access.redhat.com/errata/RHSA-2007:1045", "type": "redhat", "title": "(RHSA-2007:1045) Moderate: net-snmp security update", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:39:14", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": " [5.0.9-2.30E.23]\n \n - fix bulkwalk security flaw (#366591) ", "edition": 4, "modified": "2007-11-16T00:00:00", "published": "2007-11-16T00:00:00", "id": "ELSA-2007-1045", "href": "http://linux.oracle.com/errata/ELSA-2007-1045.html", "title": "Moderate: net-snmp security update ", "type": "oraclelinux", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "seebug": [{"lastseen": "2017-11-19T21:55:24", "description": "BUGTRAQ ID: 26378\r\nCVE(CAN) ID: CVE-2007-5846\r\n\r\nNet-SNMP\u662f\u4e00\u4e2a\u514d\u8d39\u7684\u3001\u5f00\u653e\u6e90\u7801\u7684SNMP\u5b9e\u73b0\uff0c\u4ee5\u524d\u79f0\u4e3aUCD-SNMP\u3002\r\n\r\nNet-SNMP\u5728\u5904\u7406\u7578\u5f62\u7684SNMP GETBULK\u8bf7\u6c42\u65f6\u5b58\u5728\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u6b64\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5668\u4e0d\u53ef\u7528\u3002\r\n\r\nNet-SNMP\u6ca1\u6709\u6b63\u786e\u5730\u5904\u7406SNMP GETBULK\u8bf7\u6c42\uff0c\u5982\u679c\u8fdc\u7a0b\u653b\u51fb\u8005\u53d1\u9001\u4e86\u5305\u542b\u6709\u8d85\u957fmax-repetitions\u5b57\u6bb5\u7684\u7578\u5f62SNMP GETBULK\u8bf7\u6c42\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5bfc\u81f4\u8017\u5c3d\u5927\u91cfCPU\u548c\u5185\u5b58\u8d44\u6e90\u3002\n0\nNet-SNMP net-snmp &lt; 5.4.1\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n&lt;a href=&quot;http://sourceforge.net/projects/net-snmp/&quot; target=&quot;_blank&quot;&gt;http://sourceforge.net/projects/net-snmp/&lt;/a&gt;", "published": "2007-11-09T00:00:00", "type": "seebug", "title": "Net-SNMP GETBULK\u8fdc\u7a0b\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvelist": ["CVE-2007-5846"], "modified": "2007-11-09T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-2401", "id": "SSV:2401", "sourceData": "", "sourceHref": "", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:48", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846"], "description": "SNMP (Simple Network Management Protocol) is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an SNMP library, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl mib browser. This package contains the snmpd and snmptrapd daemons, documentation, etc. You will probably also want to install the net-snmp-utils package, which contains NET-SNMP utilities. Building option: \t--without tcp_wrappers : disable tcp_wrappers support ", "modified": "2007-11-20T17:53:55", "published": "2007-11-20T17:53:55", "id": "FEDORA:LAKHRU6R016826", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 7 Update: net-snmp-5.4-16.fc7", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:49", "bulletinFamily": "unix", "cvelist": ["CVE-2007-5846", "CVE-2008-0960", "CVE-2008-2292"], "description": "SNMP (Simple Network Management Protocol) is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an SNMP library, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl mib browser. This package contains the snmpd and snmptrapd daemons, documentation, etc. You will probably also want to install the net-snmp-utils package, which contains NET-SNMP utilities. Building option: \t--without tcp_wrappers : disable tcp_wrappers support ", "modified": "2008-06-11T04:39:52", "published": "2008-06-11T04:39:52", "id": "FEDORA:M5B4OQS6020259", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 7 Update: net-snmp-5.4-18.fc7", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-12T10:06:08", "description": " - Fri Oct 19 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-16\n\n - License: field fixed to 'BSD and CMU'\n\n - fix hrSWInst (#250237)\n\n - fix leak in UDP transport (#247771)\n\n - fix remote DoS attack (CVE-2007-5846)\n\n - Mon Oct 8 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-15\n\n - License: field changed to MIT\n\n - fix segfault on parsing smuxpeer without password\n (#316621)\n\n - Thu Jun 28 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-14\n\n - fix snmptrapd hostname logging (#238587)\n\n - fix udpEndpointProcess remote IP address (#236551)\n\n - fix -M option of net-snmp-utils (#244784)\n\n - default snmptrapd.conf added (#243536)\n\n - fix crash when multiple exec statements have the same\n name (#243536)\n\n - fix ugly error message when more interfaces share one IP\n address (#209861)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 25, "published": "2007-11-26T00:00:00", "title": "Fedora 7 : net-snmp-5.4-16.fc7 (2007-3019)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2007-11-26T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:net-snmp-debuginfo", "p-cpe:/a:fedoraproject:fedora:net-snmp-devel", "cpe:/o:fedoraproject:fedora:7", "p-cpe:/a:fedoraproject:fedora:net-snmp", "p-cpe:/a:fedoraproject:fedora:net-snmp-libs", "p-cpe:/a:fedoraproject:fedora:net-snmp-perl", "p-cpe:/a:fedoraproject:fedora:net-snmp-utils"], "id": "FEDORA_2007-3019.NASL", "href": "https://www.tenable.com/plugins/nessus/28303", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2007-3019.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(28303);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_bugtraq_id(26378);\n script_xref(name:\"FEDORA\", value:\"2007-3019\");\n\n script_name(english:\"Fedora 7 : net-snmp-5.4-16.fc7 (2007-3019)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fri Oct 19 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-16\n\n - License: field fixed to 'BSD and CMU'\n\n - fix hrSWInst (#250237)\n\n - fix leak in UDP transport (#247771)\n\n - fix remote DoS attack (CVE-2007-5846)\n\n - Mon Oct 8 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-15\n\n - License: field changed to MIT\n\n - fix segfault on parsing smuxpeer without password\n (#316621)\n\n - Thu Jun 28 2007 Jan Safranek <jsafranek at redhat.com>\n 5.4-14\n\n - fix snmptrapd hostname logging (#238587)\n\n - fix udpEndpointProcess remote IP address (#236551)\n\n - fix -M option of net-snmp-utils (#244784)\n\n - default snmptrapd.conf added (#243536)\n\n - fix crash when multiple exec statements have the same\n name (#243536)\n\n - fix ugly error message when more interfaces share one IP\n address (#209861)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=247771\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=250237\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2007-November/005017.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b40777ec\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:net-snmp-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 7.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-5.4-16.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-debuginfo-5.4-16.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-devel-5.4-16.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-libs-5.4-16.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-perl-5.4-16.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"net-snmp-utils-5.4-16.fc7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp / net-snmp-debuginfo / net-snmp-devel / net-snmp-libs / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T14:02:14", "description": "This update of net-snmp fixes the following bugs :\n\n - Default and configurable maximum number of varbinds\n returnable to a GETBULK request. (CVE-2007-5846)\n\n - Add option to ignore accepted connections.", "edition": 23, "published": "2009-09-24T00:00:00", "title": "SuSE9 Security Update : net-snmp (YOU Patch Number 12022)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2009-09-24T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE9_12022.NASL", "href": "https://www.tenable.com/plugins/nessus/41178", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(41178);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n\n script_name(english:\"SuSE9 Security Update : net-snmp (YOU Patch Number 12022)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 9 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of net-snmp fixes the following bugs :\n\n - Default and configurable maximum number of varbinds\n returnable to a GETBULK request. (CVE-2007-5846)\n\n - Add option to ignore accepted connections.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-5846.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply YOU patch number 12022.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/12/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 9 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SUSE9\", reference:\"net-snmp-5.1.3.1-0.20\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"net-snmp-devel-5.1.3.1-0.20\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"perl-SNMP-5.1.3.1-0.20\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"net-snmp-32bit-9-200712130003\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T14:02:13", "description": "This update of net-snmp fixes the following bugs :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request. (CVE-2007-5846)\n\n - added option to ignore accepted connections", "edition": 23, "published": "2012-04-23T00:00:00", "title": "SuSE9 Security Update : net-snmp (YOU Patch Number 11999)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2012-04-23T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE9_11999.NASL", "href": "https://www.tenable.com/plugins/nessus/58226", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(58226);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n\n script_name(english:\"SuSE9 Security Update : net-snmp (YOU Patch Number 11999)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 9 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of net-snmp fixes the following bugs :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request. (CVE-2007-5846)\n\n - added option to ignore accepted connections\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-5846.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply YOU patch number 11999.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 9 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"net-snmp-5.1.3.1-0.17.2\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"net-snmp-32bit-9-200711271522\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"net-snmp-devel-5.1.3.1-0.17.2\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"perl-SNMP-5.1.3.1-0.17.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-06T09:25:13", "description": "Updated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.", "edition": 27, "published": "2009-04-23T00:00:00", "title": "CentOS 3 / 4 : net-snmp (CESA-2007:1045)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2009-04-23T00:00:00", "cpe": ["p-cpe:/a:centos:centos:net-snmp-utils", "p-cpe:/a:centos:centos:net-snmp-libs", "cpe:/o:centos:centos:4", "p-cpe:/a:centos:centos:net-snmp-perl", "p-cpe:/a:centos:centos:net-snmp", "p-cpe:/a:centos:centos:net-snmp-devel", "cpe:/o:centos:centos:3"], "id": "CENTOS_RHSA-2007-1045.NASL", "href": "https://www.tenable.com/plugins/nessus/36614", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2007:1045 and \n# CentOS Errata and Security Advisory 2007:1045 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(36614);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_bugtraq_id(26378);\n script_xref(name:\"RHSA\", value:\"2007:1045\");\n\n script_name(english:\"CentOS 3 / 4 : net-snmp (CESA-2007:1045)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2007-November/014433.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?166fe8af\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2007-November/014439.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c02d291b\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2007-November/014440.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7c772c19\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2007-November/014443.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ee3ce240\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected net-snmp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:net-snmp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:net-snmp-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:net-snmp-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/11/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 3.x / 4.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-3\", reference:\"net-snmp-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"CentOS-3\", reference:\"net-snmp-devel-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"CentOS-3\", reference:\"net-snmp-libs-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"CentOS-3\", reference:\"net-snmp-perl-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"CentOS-3\", reference:\"net-snmp-utils-5.0.9-2.30E.23\")) flag++;\n\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"net-snmp-devel-5.1.2-11.c4.11.1\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"net-snmp-libs-5.1.2-11.c4.11.1\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"net-snmp-perl-5.1.2-11.c4.11.1\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"net-snmp-utils-5.1.2-11.c4.11.1\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp / net-snmp-devel / net-snmp-libs / net-snmp-perl / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T13:05:56", "description": "Updated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.", "edition": 28, "published": "2007-11-16T00:00:00", "title": "RHEL 3 / 4 / 5 : net-snmp (RHSA-2007:1045)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2007-11-16T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:3", "cpe:/o:redhat:enterprise_linux:4", "cpe:/o:redhat:enterprise_linux:5", "p-cpe:/a:redhat:enterprise_linux:net-snmp", "p-cpe:/a:redhat:enterprise_linux:net-snmp-devel", "p-cpe:/a:redhat:enterprise_linux:net-snmp-libs", "p-cpe:/a:redhat:enterprise_linux:net-snmp-utils", "cpe:/o:redhat:enterprise_linux:5.1", "cpe:/o:redhat:enterprise_linux:4.6", "p-cpe:/a:redhat:enterprise_linux:net-snmp-perl"], "id": "REDHAT-RHSA-2007-1045.NASL", "href": "https://www.tenable.com/plugins/nessus/28248", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2007:1045. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(28248);\n script_version(\"1.27\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_bugtraq_id(26378);\n script_xref(name:\"RHSA\", value:\"2007:1045\");\n\n script_name(english:\"RHEL 3 / 4 / 5 : net-snmp (RHSA-2007:1045)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-5846\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2007:1045\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:net-snmp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:net-snmp-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:net-snmp-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/11/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 3.x / 4.x / 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2007:1045\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL3\", reference:\"net-snmp-5.0.9-2.30E.23\")) flag++;\n\n if (rpm_check(release:\"RHEL3\", reference:\"net-snmp-devel-5.0.9-2.30E.23\")) flag++;\n\n if (rpm_check(release:\"RHEL3\", reference:\"net-snmp-libs-5.0.9-2.30E.23\")) flag++;\n\n if (rpm_check(release:\"RHEL3\", reference:\"net-snmp-perl-5.0.9-2.30E.23\")) flag++;\n\n if (rpm_check(release:\"RHEL3\", reference:\"net-snmp-utils-5.0.9-2.30E.23\")) flag++;\n\n\n if (rpm_check(release:\"RHEL4\", reference:\"net-snmp-5.1.2-11.el4_6.11.1\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"net-snmp-devel-5.1.2-11.el4_6.11.1\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"net-snmp-libs-5.1.2-11.el4_6.11.1\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"net-snmp-perl-5.1.2-11.el4_6.11.1\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"net-snmp-utils-5.1.2-11.el4_6.11.1\")) flag++;\n\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"net-snmp-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"net-snmp-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"net-snmp-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"net-snmp-devel-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"net-snmp-libs-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"net-snmp-perl-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"net-snmp-perl-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"net-snmp-perl-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"net-snmp-utils-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"net-snmp-utils-5.3.1-19.el5_1.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"net-snmp-utils-5.3.1-19.el5_1.1\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp / net-snmp-devel / net-snmp-libs / net-snmp-perl / etc\");\n }\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-01T05:48:31", "description": "It is possible to disable the remote SNMP daemon by sending a GETBULK\nrequest with a large value for 'max-repetitions'. A remote attacker\nmay be able to leverage this issue to cause the daemon to consume\nexcessive memory and CPU on the affected system while it tries\nunsuccessfully to process the request, thereby denying service to\nlegitimate users.", "edition": 24, "published": "2007-11-09T00:00:00", "title": "SNMP GETBULK Large max-repetitions Remote DoS", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2021-01-02T00:00:00", "cpe": [], "id": "SNMP_GETBULK_MAX_REPETITIONS_DOS.NASL", "href": "https://www.tenable.com/plugins/nessus/27841", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(27841);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2018/07/30 15:31:32\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_bugtraq_id(26378);\n\n script_name(english:\"SNMP GETBULK Large max-repetitions Remote DoS\");\n script_summary(english:\"Sends a GETBULK request with large value for max-repetitions\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SNMP daemon is susceptible to a denial of service attack.\");\n script_set_attribute(attribute:\"description\", value:\n\"It is possible to disable the remote SNMP daemon by sending a GETBULK\nrequest with a large value for 'max-repetitions'. A remote attacker\nmay be able to leverage this issue to cause the daemon to consume\nexcessive memory and CPU on the affected system while it tries\nunsuccessfully to process the request, thereby denying service to\nlegitimate users.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5aef7a73\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?355da3c5\");\n script_set_attribute(attribute:\"solution\", value:\n\"Disable the SNMP service on the remote host if you do not use it. \nOtherwise, upgrade to version 5.4.1 or later if using Net-SNMP.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/05/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n \n script_category(ACT_DENIAL);\n script_family(english:\"SNMP\");\n script_copyright(english:\"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"snmp_settings.nasl\",\"find_service2.nasl\");\n script_require_keys(\"SNMP/community\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"snmp_func.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"audit.inc\");\n\n\ncommunity = get_kb_item_or_exit(\"SNMP/community\");\n\n\nport = get_kb_item(\"SNMP/port\");\nif (!port) port = 161;\nif (! get_udp_port_state(port)) audit(AUDIT_PORT_CLOSED, port, \"UDP\");\n\nsoc = open_sock_udp(port);\nif (!soc) audit(AUDIT_SOCK_FAIL, port, \"UDP\");\n\n\n# Make sure a request for sysDesc works.\noid = \"1.3.6.1.2.1.1.1.0\";\ndesc = snmp_request(socket:soc, community:community, oid:oid);\nif (isnull(desc)) audit(AUDIT_RESP_NOT, port, \"an SNMP sysDesc request\", \"UDP\");\n\n# Ignore Microsoft's SNMP service.\n#\n# nb: these strings are from os_fingerprint_snmp.nasl\nif (\n desc =~ \"Hardware:.*Software: Windows \" ||\n desc == \"Microsoft Corp. Windows 98.\" ||\n desc =~ \"^Microsoft Windows CE Version\"\n) exit (0, \"The SNMP server listening on UDP port \"+port+\" is from Microsoft.\");\n\nres = snmp_get_bulk_request(\n socket:soc,\n community:community,\n oid:oid,\n non_repeaters:0,\n max_repetitions:240000\n);\n\nif (isnull(res) || report_paranoia > 1)\n{\n # There's a problem if our original request no longer works.\n desc = snmp_request(socket:soc, community:community, oid:oid);\n if (isnull(desc))\n {\n security_hole(port:port, protocol:\"udp\");\n exit(0);\n }\n}\naudit(AUDIT_LISTEN_NOT_VULN, \"SNMP server\", port, \"(unknown version)\", \"UDP\"); \n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-07T11:51:47", "description": "The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers\nto cause a denial of service (CPU and memory consumption) via a\nGETBULK request with a large max-repeaters value.\n\nUpdated packages fix this issue.", "edition": 24, "published": "2007-11-20T00:00:00", "title": "Mandrake Linux Security Advisory : net-snmp (MDKSA-2007:225)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2007-11-20T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:perl-NetSNMP", "p-cpe:/a:mandriva:linux:libnet-snmp10-static-devel", "p-cpe:/a:mandriva:linux:lib64net-snmp10-devel", "cpe:/o:mandriva:linux:2007", "p-cpe:/a:mandriva:linux:net-snmp-mibs", "cpe:/o:mandriva:linux:2007.1", "p-cpe:/a:mandriva:linux:net-snmp-trapd", "p-cpe:/a:mandriva:linux:lib64net-snmp10", "p-cpe:/a:mandriva:linux:libnet-snmp10-devel", "p-cpe:/a:mandriva:linux:lib64net-snmp10-static-devel", "p-cpe:/a:mandriva:linux:net-snmp", "p-cpe:/a:mandriva:linux:libnet-snmp10", "p-cpe:/a:mandriva:linux:net-snmp-utils"], "id": "MANDRAKE_MDKSA-2007-225.NASL", "href": "https://www.tenable.com/plugins/nessus/28275", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2007:225. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(28275);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_xref(name:\"MDKSA\", value:\"2007:225\");\n\n script_name(english:\"Mandrake Linux Security Advisory : net-snmp (MDKSA-2007:225)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The SNMP agent in net-snmp 5.4.1 and earlier allows remote attackers\nto cause a denial of service (CPU and memory consumption) via a\nGETBULK request with a large max-repeaters value.\n\nUpdated packages fix this issue.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64net-snmp10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64net-snmp10-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64net-snmp10-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnet-snmp10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnet-snmp10-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnet-snmp10-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:net-snmp-mibs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:net-snmp-trapd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:net-snmp-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:perl-NetSNMP\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64net-snmp10-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64net-snmp10-devel-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"x86_64\", reference:\"lib64net-snmp10-static-devel-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libnet-snmp10-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libnet-snmp10-devel-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", cpu:\"i386\", reference:\"libnet-snmp10-static-devel-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"net-snmp-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"net-snmp-mibs-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"net-snmp-trapd-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"net-snmp-utils-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"perl-NetSNMP-5.3.1-2.1mdv2007.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64net-snmp10-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64net-snmp10-devel-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"x86_64\", reference:\"lib64net-snmp10-static-devel-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libnet-snmp10-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libnet-snmp10-devel-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", cpu:\"i386\", reference:\"libnet-snmp10-static-devel-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"net-snmp-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"net-snmp-mibs-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"net-snmp-trapd-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"net-snmp-utils-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"perl-NetSNMP-5.3.1-3.1mdv2007.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T12:44:04", "description": "From Red Hat Security Advisory 2007:1045 :\n\nUpdated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.", "edition": 25, "published": "2013-07-12T00:00:00", "title": "Oracle Linux 3 / 4 : net-snmp (ELSA-2007-1045)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2013-07-12T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:net-snmp-perl", "p-cpe:/a:oracle:linux:net-snmp-utils", "p-cpe:/a:oracle:linux:net-snmp", "p-cpe:/a:oracle:linux:net-snmp-devel", "cpe:/o:oracle:linux:3", "p-cpe:/a:oracle:linux:net-snmp-libs", "cpe:/o:oracle:linux:4"], "id": "ORACLELINUX_ELSA-2007-1045.NASL", "href": "https://www.tenable.com/plugins/nessus/67608", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2007:1045 and \n# Oracle Linux Security Advisory ELSA-2007-1045 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(67608);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n script_bugtraq_id(26378);\n script_xref(name:\"RHSA\", value:\"2007:1045\");\n\n script_name(english:\"Oracle Linux 3 / 4 : net-snmp (ELSA-2007-1045)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2007:1045 :\n\nUpdated net-snmp packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 3, 4, and 5.\n\nSimple Network Management Protocol (SNMP) is a protocol used for\nnetwork management.\n\nA flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\n\nAll users of net-snmp are advised to upgrade to these updated\npackages, which contain a backported patch to resolve this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2007-December/000426.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2007-November/000398.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected net-snmp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:net-snmp-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:net-snmp-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:net-snmp-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/11/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/12/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 3 / 4\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"net-snmp-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"net-snmp-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"net-snmp-devel-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"net-snmp-devel-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"net-snmp-libs-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"net-snmp-libs-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"net-snmp-perl-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"net-snmp-perl-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"net-snmp-utils-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"net-snmp-utils-5.0.9-2.30E.23\")) flag++;\n\nif (rpm_check(release:\"EL4\", cpu:\"i386\", reference:\"net-snmp-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"x86_64\", reference:\"net-snmp-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"i386\", reference:\"net-snmp-devel-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"x86_64\", reference:\"net-snmp-devel-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"i386\", reference:\"net-snmp-libs-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"x86_64\", reference:\"net-snmp-libs-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"i386\", reference:\"net-snmp-perl-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"x86_64\", reference:\"net-snmp-perl-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"i386\", reference:\"net-snmp-utils-5.1.2-11.el4_6.11.1\")) flag++;\nif (rpm_check(release:\"EL4\", cpu:\"x86_64\", reference:\"net-snmp-utils-5.1.2-11.el4_6.11.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp / net-snmp-devel / net-snmp-libs / net-snmp-perl / etc\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T13:43:48", "description": "A flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)", "edition": 24, "published": "2012-08-01T00:00:00", "title": "Scientific Linux Security Update : net-snmp on SL5.x, SL4.x, SL3.x i386/x86_64", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2012-08-01T00:00:00", "cpe": ["x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20071115_NET_SNMP_ON_SL5_X.NASL", "href": "https://www.tenable.com/plugins/nessus/60304", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(60304);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n\n script_name(english:\"Scientific Linux Security Update : net-snmp on SL5.x, SL4.x, SL3.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A flaw was discovered in the way net-snmp handled certain requests. A\nremote attacker who can connect to the snmpd UDP port (161 by default)\ncould send a malicious packet causing snmpd to crash, resulting in a\ndenial of service. (CVE-2007-5846)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0711&L=scientific-linux-errata&T=0&P=2993\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?de4ba73a\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL3\", reference:\"net-snmp-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"SL3\", reference:\"net-snmp-devel-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"SL3\", reference:\"net-snmp-libs-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"SL3\", reference:\"net-snmp-perl-5.0.9-2.30E.23\")) flag++;\nif (rpm_check(release:\"SL3\", reference:\"net-snmp-utils-5.0.9-2.30E.23\")) flag++;\n\nif (rpm_check(release:\"SL4\", reference:\"net-snmp-5.1.2-11.11.1\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"net-snmp-devel-5.1.2-11.11.1\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"net-snmp-libs-5.1.2-11.11.1\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"net-snmp-perl-5.1.2-11.11.1\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"net-snmp-utils-5.1.2-11.11.1\")) flag++;\n\nif (rpm_check(release:\"SL5\", reference:\"net-snmp-5.3.1-19.el5.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"net-snmp-devel-5.3.1-19.el5.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"net-snmp-libs-5.3.1-19.el5.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"net-snmp-perl-5.3.1-19.el5.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"net-snmp-utils-5.3.1-19.el5.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-01-17T14:46:48", "description": "This update of net-snmp fixes the following bugs :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request (CVE-2007-5846) \n\n - crash when smux peers were configured with empty\n passwords \n\n - the UCD-SNMP-MIB::memCached.0 SNMP object was missing \n\n - the snmptrap command from the net-snmp package sends\n traps per default on the wrong port.", "edition": 24, "published": "2008-01-08T00:00:00", "title": "openSUSE 10 Security Update : net-snmp (net-snmp-4753)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-5846"], "modified": "2008-01-08T00:00:00", "cpe": ["cpe:/o:novell:opensuse:10.2", "p-cpe:/a:novell:opensuse:perl-SNMP", "p-cpe:/a:novell:opensuse:net-snmp-devel", "p-cpe:/a:novell:opensuse:net-snmp", "p-cpe:/a:novell:opensuse:net-snmp-32bit"], "id": "SUSE_NET-SNMP-4753.NASL", "href": "https://www.tenable.com/plugins/nessus/29882", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update net-snmp-4753.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(29882);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-5846\");\n\n script_name(english:\"openSUSE 10 Security Update : net-snmp (net-snmp-4753)\");\n script_summary(english:\"Check for the net-snmp-4753 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update of net-snmp fixes the following bugs :\n\n - default and configurable maximum number of varbinds\n returnable to a GETBULK request (CVE-2007-5846) \n\n - crash when smux peers were configured with empty\n passwords \n\n - the UCD-SNMP-MIB::memCached.0 SNMP object was missing \n\n - the snmptrap command from the net-snmp package sends\n traps per default on the wrong port.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected net-snmp packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_cwe_id(399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:net-snmp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:net-snmp-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:net-snmp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:perl-SNMP\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.2\", reference:\"net-snmp-5.4.rc2-6\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"net-snmp-devel-5.4.rc2-6\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"perl-SNMP-5.4.rc2-6\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", cpu:\"x86_64\", reference:\"net-snmp-32bit-5.4.rc2-6\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"net-snmp\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}], "vmware": [{"lastseen": "2019-11-06T16:05:53", "bulletinFamily": "unix", "cvelist": ["CVE-2006-7228", "CVE-2007-5846", "CVE-2007-1660", "CVE-2008-0003"], "description": "a. Updated pcre Service Console package addresses several security issues \nThe pcre package contains the Perl-Compatible Regular Expression library. \npcre is used by various Service Console utilities. \n \nSeveral security issues were discovered in the way PCRE handles regular expressions. If an application linked against PCRE parsed a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. \n \nVMware would like to thank Ludwig Nussel for reporting these issues. \n \nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2006-7228 and CVE-2007-1660 to these issues. \n \nRPM Updated: \npcre-3.9-10.4.i386.rpm \n \nVMware ESX 3.5 patch ESX350-200803214-UG(pcre, net-snmp) \n \nVMware ESX 3.0.2 patch ESX-1004217(pcre) \nVMware ESX 3.0.1 patch ESX-1004187(pcre)\n", "edition": 4, "modified": "2008-06-04T00:00:00", "published": "2008-04-15T00:00:00", "id": "VMSA-2008-0007", "href": "https://www.vmware.com/security/advisories/VMSA-2008-0007.html", "title": "Moderate Updated Service Console packages pcre, net-snmp, and OpenPegasus", "type": "vmware", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}