net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.

According to the version of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release. (CVE-2019-20892)

Impact

When exploited, this vulnerability may cause the SNMP process to restart, leading to a disruption in SNMP services.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the net-snmp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - net-snmp before 5.8.1.pre1 has a double free in     usm_free_usmStateReference in snmplib/snmpusm.c via an     SNMPv3 GetBulk request. NOTE: this affects net-snmp     packages shipped to end users by multiple Linux     distributions, but might not affect an upstream     release.(CVE-2019-20892)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202008-12 (Net-SNMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Net-SNMP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the net package has been released.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4410-1 advisory.

    A double-free bug was discovered in snmpd server. An authenticated user could potentially cause a DoS by     sending a crafted request to the server. (CVE-2019-20892)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
151898	EulerOS Virtualization 3.0.2.2 : net-snmp (EulerOS-SA-2021-2149)	Nessus	Huawei Local Security Checks	medium
147440	EulerOS Virtualization 2.9.1 : net-snmp (EulerOS-SA-2021-1614)	Nessus	Huawei Local Security Checks	high
143110	F5 Networks BIG-IP : SNMP vulnerability (K45212738)	Nessus	F5 Networks Local Security Checks	medium
142584	EulerOS Virtualization 3.0.6.6 : net-snmp (EulerOS-SA-2020-2470)	Nessus	Huawei Local Security Checks	medium
142257	EulerOS 2.0 SP2 : net-snmp (EulerOS-SA-2020-2370)	Nessus	Huawei Local Security Checks	high
142109	EulerOS 2.0 SP5 : net-snmp (EulerOS-SA-2020-2259)	Nessus	Huawei Local Security Checks	medium
140823	EulerOS 2.0 SP3 : net-snmp (EulerOS-SA-2020-2056)	Nessus	Huawei Local Security Checks	high
140324	EulerOS Virtualization for ARM 64 3.0.2.0 : net-snmp (EulerOS-SA-2020-1954)	Nessus	Huawei Local Security Checks	medium
140009	EulerOS Virtualization for ARM 64 3.0.6.0 : net-snmp (EulerOS-SA-2020-1906)	Nessus	Huawei Local Security Checks	medium
139888	GLSA-202008-12 : Net-SNMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
139144	EulerOS 2.0 SP8 : net-snmp (EulerOS-SA-2020-1814)	Nessus	Huawei Local Security Checks	medium
138813	Photon OS 3.0: Net PHSA-2020-3.0-0114	Nessus	PhotonOS Local Security Checks	medium
138520	Photon OS 2.0: Net PHSA-2020-2.0-0262	Nessus	PhotonOS Local Security Checks	medium
138517	Photon OS 1.0: Net PHSA-2020-1.0-0308	Nessus	PhotonOS Local Security Checks	medium
138135	Ubuntu 20.04 LTS : Net-SNMP vulnerability (USN-4410-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-20892

medium

Tenable Plugins

medium

high

medium

medium

high

medium

high

medium

medium

high

medium

medium

medium

medium

medium