1. CVE-Search
  2. CVE-2008-6123
ID CVE-2008-6123
Summary The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
References
Vulnerable Configurations
  • cpe:2.3:a:net-snmp:net-snmp:5.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.1:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.2:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.3:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.4:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:net-snmp:net-snmp:5.4.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:net-snmp:net-snmp:5.4.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise:9-11:*:*:*:*:*:*:*
    cpe:2.3:o:suse:linux_enterprise:9-11:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:10.3-11.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:10.3-11.1:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 12-01-2024 - 20:41)
Impact:
Exploitability:
CWE CWE-863
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
oval via4
accepted 2013-04-29T04:04:21.138-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
description The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
family unix
id oval:org.mitre.oval:def:10289
status accepted
submitted 2010-07-09T03:56:16-04:00
title The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
version 30
redhat via4
advisories
rhsa
id RHSA-2009:0295
rpms
  • net-snmp-0:5.0.9-2.30E.27
  • net-snmp-debuginfo-0:5.0.9-2.30E.27
  • net-snmp-devel-0:5.0.9-2.30E.27
  • net-snmp-libs-0:5.0.9-2.30E.27
  • net-snmp-perl-0:5.0.9-2.30E.27
  • net-snmp-utils-0:5.0.9-2.30E.27
refmap via4
confirm
misc http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367
mlist
  • [oss-security] 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
  • [oss-security] 20090212 Re: CVE Request -- net-snmp (sensitive host information disclosure)
  • [oss-security] Re: 20090212 CVE Request -- net-snmp (sensitive host information disclosure)
sectrack 1021921
secunia
  • 34499
  • 35416
  • 35685
suse
  • SUSE-SR:2009:011
  • SUSE-SR:2009:012
  • SUSE-SR:2010:003
Last major update 12-01-2024 - 20:41
Published 12-02-2009 - 16:30
Last modified 12-01-2024 - 20:41
Back to Top