A vulnerability was found in net-snmp 5.0.1/5.0.3/5.0.4 Pre2 (Network Management Software) and classified as problematic. Affected by this issue is the function handle_var_requests of the file snmp_agent.c of the component SNMP Daemon. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. CVE summarizes:

The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.

The weakness was released 10/11/2002 by Andrew (Website). The advisory is shared for download at marc.theaimsgroup.com. This vulnerability is handled as CVE-2002-1170. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at X-Force (10250).

Productinfo

Type

• Network Management Software

Name

• net-snmp

Version

• 5.0.1
• 5.0.3
• 5.0.4 Pre2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion