CVEvulnerability
CVE-2008-6123
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-02-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-863
Description
The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
Affected configurations
• net-snmp net-snmp (>= 5.0.9 <= 5.4.2.1)
• opensuse opensuse 10.3-11.1
• opensuse opensuse 11.2
• suse linux enterprise 9-11
• redhat enterprise linux 3.0
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- http://bugs.gentoo.org/show_bug.cgi?id=250429 Exploit, Issue Tracking
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html Mailing List
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367 Product
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367 Product
- http://secunia.com/advisories/34499 Broken Link
- http://secunia.com/advisories/35416 Broken Link
- http://secunia.com/advisories/35685 Broken Link
- http://www.openwall.com/lists/oss-security/2009/02/12/2 Mailing List
- http://www.openwall.com/lists/oss-security/2009/02/12/4 Mailing List
- http://www.openwall.com/lists/oss-security/2009/02/12/7 Mailing List
- http://www.redhat.com/support/errata/RHSA-2009-0295.html Not Applicable
- http://www.securitytracker.com/id?1021921 Broken Link, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=485211 Issue Tracking, Patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10289 Broken Link
- http://bugs.gentoo.org/show_bug.cgi?id=250429 Exploit, Issue Tracking
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html Mailing List
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/snmplib/snmpUDPDomain.c?r1=17325&r2=17367&pathrev=17367 Product
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367 Product
- http://secunia.com/advisories/34499 Broken Link
- http://secunia.com/advisories/35416 Broken Link
- http://secunia.com/advisories/35685 Broken Link
- http://www.openwall.com/lists/oss-security/2009/02/12/2 Mailing List
- http://www.openwall.com/lists/oss-security/2009/02/12/4 Mailing List
- http://www.openwall.com/lists/oss-security/2009/02/12/7 Mailing List
- http://www.redhat.com/support/errata/RHSA-2009-0295.html Not Applicable
- http://www.securitytracker.com/id?1021921 Broken Link, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=485211 Issue Tracking, Patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10289 Broken Link