RHEL 6 : net-snmp (RHSA-2012:0876)

medium Nessus Plugin ID 59592

Synopsis

The remote Red Hat host is missing a security update for net-snmp.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0876 advisory.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

An array index error, leading to an out-of-bounds buffer read flaw, was found in the way the net-snmp agent looked up entries in the extension table. A remote attacker with read privileges to a Management Information Base (MIB) subtree handled by the extend directive (in /etc/snmp/snmpd.conf) could use this flaw to crash snmpd via a crafted SNMP GET request. (CVE-2012-2141)

These updated net-snmp packages also include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

All users of net-snmp are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, the snmpd and snmptrapd daemons will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL net-snmp package based on the guidance in RHSA-2012:0876.

See Also

http://www.nessus.org/u?38b1883d

http://www.nessus.org/u?38e305ff

https://access.redhat.com/errata/RHSA-2012:0876

https://access.redhat.com/security/updates/classification/#moderate

https://bugzilla.redhat.com/show_bug.cgi?id=736580

https://bugzilla.redhat.com/show_bug.cgi?id=748410

https://bugzilla.redhat.com/show_bug.cgi?id=754275

https://bugzilla.redhat.com/show_bug.cgi?id=757685

https://bugzilla.redhat.com/show_bug.cgi?id=786931

https://bugzilla.redhat.com/show_bug.cgi?id=788954

https://bugzilla.redhat.com/show_bug.cgi?id=799291

https://bugzilla.redhat.com/show_bug.cgi?id=815813

https://bugzilla.redhat.com/show_bug.cgi?id=822480

Plugin Details

Severity: Medium

ID: 59592

File Name: redhat-RHSA-2012-0876.nasl

Version: 1.22

Type: local

Agent: unix

Published: 6/20/2012

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Moderate

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2012-2141

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:net-snmp-perl, p-cpe:/a:redhat:enterprise_linux:net-snmp-devel, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:net-snmp-utils, p-cpe:/a:redhat:enterprise_linux:net-snmp-libs, p-cpe:/a:redhat:enterprise_linux:net-snmp-python, p-cpe:/a:redhat:enterprise_linux:net-snmp

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 6/20/2012

Vulnerability Publication Date: 8/14/2012

Reference Information

CVE: CVE-2012-2141

BID: 53255

RHSA: 2012:0876