Buffer Overflow in net-snmp Could Lead to Out-of-Bounds Memory Access

CVE-2022-24805

What is CVE-2022-24805?

A vulnerability exists in the Net-SNMP suite that involves a buffer overflow in the handling of the 'INDEX' within the NET-SNMP-VACM-MIB. This issue results in the potential for out-of-bounds memory access, which can be exploited by users holding read-only credentials. To mitigate the risk, users are advised to upgrade to version 5.9.2 or later, where the vulnerability is patched. For enhanced security, it is recommended to utilize strong SNMPv3 credentials, avoid sharing these credentials, and restrict SNMP access through rigorous IP address filtering. For those using SNMPv1 or SNMPv2c, adopting a complex community string is crucial.

References