Descriptionnet-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a `SET` request to `NET-SNMP-AGENT-MIB::nsLogTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3088-1, DSA-5209-1
Debian Bugs1016139

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
net-snmp (PTS)bullseye (security), bullseye5.9+dfsg-4+deb11u1fixed
sid, trixie5.9.4+dfsg-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

Notes (fixed in 5.9.3) (v5.9.2.pre1) (v5.9.2.pre1)

Search for package or bug name: Reporting problems