ALEA-2021:4439 net-snmp bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2021-42372

A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service...

CVE-2021-42372

A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service...

CVE-2021-42372

A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service...

CVE-2021-42372

CVE-2021-42372 affects XoruX LPAR2RRD and STOR2RRD prior to version 7.30. The underlying issue is a shell command injection in the HW Events SNMP community, allowing authenticated remote attackers to execute arbitrary shell commands as the service user. Red Hat and other sources confirm the affec...

PT-2021-23602 · Unknown +1 · Xorux Lpar2Rrd +1

Name of the Vulnerable Software and Affected Versions: XoruX LPAR2RRD and STOR2RRD versions prior to 7.30 Description: A shell command injection in the HW Events SNMP community allows authenticated remote attackers to execute arbitrary shell commands as the user running the service...

CVE-2021-42372: Improper Neutralization of Special Elements used in an OS Command

A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service...

net-snmp:snmp_mib_fuzzer: Stack-buffer-overflow in parse_objecttype

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=4658956098732032 Project: net-snmp Fuzzing Engine: afl Fuzz Target: snmpmibfuzzer Job Type: aflasannet-snmp Platform Id: linux Crash Type: Stack-buffer-overfl...

LibreNMS Cross-Site Scripting Vulnerability

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . A cross-site scripting vulnerability exists in LibreNMS 21.10.2 and earlier versions. An attacker can exploit the vulnerability to inject code via a widget header...

Cisco Common Services Platform Collector Information Disclosure Vulnerability

Cisco Common Services Platform Collector CSPC is an SNMP-based tool that discovers and collects information from Cisco devices installed on the network.Cisco Common Services Platform Collector 2.10 and earlier versions of the Web Management interface contains an information disclosure...

PT-2021-7070

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family affected versions not specified Description A vulnerability in Simple Network Management Protocol SNMP trap generation for wireless clients could allow an unauthenticated,...

PT-2021-6795

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA affected versions not specified Cisco Web Security Appliance WSA affected versions not specified Cisco Secure Email and Web Manager affected versions not specified Description A vulnerability in the TCP/IP...

CVE-2021-36319

Dell Networking OS10 versions 10.4.3.x, 10.5.0.x and 10.5.1.x contain an information exposure vulnerability. A low privileged authenticated malicious user can gain access to SNMP authentication failure messages...

net-snmp:snmp_mib_fuzzer: Stack-buffer-overflow in check_utc

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=5228380673409024 Project: net-snmp Fuzzing Engine: honggfuzz Fuzz Target: snmpmibfuzzer Job Type: honggfuzzasannet-snmp Platform Id: linux Crash Type:...

PT-2021-27875

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. The crash occurs in the following functions: asn build string, snmpv3 packet build, and snmp...

net-snmp:snmp_api_fuzzer: Heap-buffer-overflow in asn_realloc_rbuild_string

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=5941786955087872 Project: net-snmp Fuzzing Engine: afl Fuzz Target: snmpapifuzzer Job Type: aflasannet-snmp Platform Id: linux Crash Type: Heap-buffer-overflo...

net-snmp:snmp_api_fuzzer: Heap-buffer-overflow in asn_build_string

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=6571319773233152 Project: net-snmp Fuzzing Engine: afl Fuzz Target: snmpapifuzzer Job Type: aflasannet-snmp Platform Id: linux Crash Type: Heap-buffer-overflo...

CVE-2021-34794 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control Vulnerability

A vulnerability in the Simple Network Management Protocol version 3 SNMPv3 access control functionality of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due t...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control Vulnerability

A vulnerability in the Simple Network Management Protocol version 3 SNMPv3 access control functionality of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due t...

NewStart CGSL CORE 5.05 / MAIN 5.05 : net-snmp Vulnerability (NS-SA-2021-0150)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has net-snmp packages installed that are affected by a vulnerability: - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root...