Vulnerabilities > CVE-2018-18066 - NULL Pointer Dereference vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
net-snmp
netapp
CWE-476
nessus

Summary

snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1081.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1081 advisory. - net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service (CVE-2018-18066) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-04-01
    plugin id135063
    published2020-04-01
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135063
    titleRHEL 7 : net-snmp (RHSA-2020:1081)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:1081. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135063);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/21");
    
      script_cve_id("CVE-2018-18066");
      script_xref(name:"RHSA", value:"2020:1081");
    
      script_name(english:"RHEL 7 : net-snmp (RHSA-2020:1081)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Red Hat host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in
    the RHSA-2020:1081 advisory.
    
      - net-snmp: NULL pointer exception in snmp_oid_compare in
        snmplib/snmp_api.c resulting in a denial of service
        (CVE-2018-18066)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/476.html");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1081");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2018-18066");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1388118");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1547355");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1695363");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1700494");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1703752");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1779609");
      script_set_attribute(attribute:"solution", value:
    "Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-18066");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_cwe_id(476);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/01");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::client");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::computenode");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7::workstation");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-agent-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-perl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:net-snmp-utils");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Red Hat Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('rpm.inc');
    
    if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item('Host/RedHat/release');
    if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);
    
    if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item('Host/cpu');
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    pkgs = [
        {'reference':'net-snmp-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-agent-libs-5.7.2-47.el7', 'cpu':'i686', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-agent-libs-5.7.2-47.el7', 'cpu':'s390', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-agent-libs-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-agent-libs-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-devel-5.7.2-47.el7', 'cpu':'i686', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-devel-5.7.2-47.el7', 'cpu':'s390', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-devel-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-devel-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-gui-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-gui-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-libs-5.7.2-47.el7', 'cpu':'i686', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-libs-5.7.2-47.el7', 'cpu':'s390', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-libs-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-libs-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-perl-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-perl-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-python-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-python-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-sysvinit-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-sysvinit-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-utils-5.7.2-47.el7', 'cpu':'s390x', 'release':'7', 'epoch':'1'},
        {'reference':'net-snmp-utils-5.7.2-47.el7', 'cpu':'x86_64', 'release':'7', 'epoch':'1'}
    ];
    
    flag = 0;
    foreach package_array ( pkgs ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (reference && release) {
        if (rpm_spec_vers_cmp) {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:TRUE)) flag++;
        }
        else
        {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch)) flag++;
        }
      }
    }
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'net-snmp / net-snmp-agent-libs / net-snmp-devel / etc');
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1035.NASL
    descriptionAccording to the version of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.(CVE-2018-18066) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-02-15
    plugin id122208
    published2019-02-15
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122208
    titleEulerOS 2.0 SP3 : net-snmp (EulerOS-SA-2019-1035)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(122208);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2018-18066"
      );
    
      script_name(english:"EulerOS 2.0 SP3 : net-snmp (EulerOS-SA-2019-1035)");
      script_summary(english:"Checks the rpm output for the updated package.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "According to the version of the net-snmp packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerability :
    
      - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP
        before 5.8 has a NULL Pointer Exception bug that can be
        used by an unauthenticated attacker to remotely cause
        the instance to crash via a crafted UDP packet,
        resulting in Denial of Service.(CVE-2018-18066)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1035
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3b409dbb");
      script_set_attribute(attribute:"solution", value:
    "Update the affected net-snmp package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:net-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:net-snmp-agent-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:net-snmp-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:net-snmp-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:net-snmp-utils");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["net-snmp-5.7.2-24.1.h1",
            "net-snmp-agent-libs-5.7.2-24.1.h1",
            "net-snmp-devel-5.7.2-24.1.h1",
            "net-snmp-libs-5.7.2-24.1.h1",
            "net-snmp-utils-5.7.2-24.1.h1"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "net-snmp");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20200407_NET_SNMP_ON_SL7_X.NASL
    description* net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service
    last seen2020-04-30
    modified2020-04-21
    plugin id135825
    published2020-04-21
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135825
    titleScientific Linux Security Update : net-snmp on SL7.x x86_64 (20200407)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(135825);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id("CVE-2018-18066");
    
      script_name(english:"Scientific Linux Security Update : net-snmp on SL7.x x86_64 (20200407)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "* net-snmp: NULL pointer exception in snmp_oid_compare in
    snmplib/snmp_api.c resulting in a denial of service"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind2004&L=SCIENTIFIC-LINUX-ERRATA&P=6398
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?280a7d0f"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-agent-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-gui");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-perl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-sysvinit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:net-snmp-utils");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/21");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-agent-libs-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-debuginfo-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-devel-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-gui-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-libs-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-perl-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-python-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-sysvinit-5.7.2-47.el7")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"net-snmp-utils-5.7.2-47.el7")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "net-snmp / net-snmp-agent-libs / net-snmp-debuginfo / etc");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2020-1081.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1081 advisory. - net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service (CVE-2018-18066) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-04-10
    plugin id135333
    published2020-04-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135333
    titleCentOS 7 : net-snmp (CESA-2020:1081)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1036.NASL
    descriptionAccording to the version of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.(CVE-2018-18066) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-02-15
    plugin id122209
    published2019-02-15
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/122209
    titleEulerOS 2.0 SP5 : net-snmp (EulerOS-SA-2019-1036)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1716.NASL
    descriptionAccording to the version of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.(CVE-2018-18066) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2019-07-22
    plugin id126844
    published2019-07-22
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126844
    titleEulerOS 2.0 SP2 : net-snmp (EulerOS-SA-2019-1716)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1214.NASL
    descriptionAccording to the version of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.i1/4^CVE-2018-18066i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-19
    modified2019-04-09
    plugin id123900
    published2019-04-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123900
    titleEulerOS Virtualization 2.5.4 : net-snmp (EulerOS-SA-2019-1214)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1436.NASL
    descriptionAccording to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was discovered that the snmp_pdu_parse() mishandles error codes and is vulnerable to a heap corruption within the parsing of the PDU prior to the authentication process. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd.(CVE-2018-1000116) - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.(CVE-2018-18066) - It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd.(CVE-2015-5621) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124939
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124939
    titleEulerOS Virtualization 3.0.1.0 : net-snmp (EulerOS-SA-2019-1436)

Redhat

advisories
bugzilla
id1779609
titleRevert free memory patch from net-snmp
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentnet-snmp-utils is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081001
        • commentnet-snmp-utils is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150002
      • AND
        • commentnet-snmp-libs is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081003
        • commentnet-snmp-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150004
      • AND
        • commentnet-snmp-devel is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081005
        • commentnet-snmp-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150008
      • AND
        • commentnet-snmp-agent-libs is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081007
        • commentnet-snmp-agent-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151636016
      • AND
        • commentnet-snmp is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081009
        • commentnet-snmp is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150010
      • AND
        • commentnet-snmp-sysvinit is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081011
        • commentnet-snmp-sysvinit is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151636025
      • AND
        • commentnet-snmp-python is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081013
        • commentnet-snmp-python is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150006
      • AND
        • commentnet-snmp-perl is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081015
        • commentnet-snmp-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhba:tst:20131150012
      • AND
        • commentnet-snmp-gui is earlier than 1:5.7.2-47.el7
          ovaloval:com.redhat.rhsa:tst:20201081017
        • commentnet-snmp-gui is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20151636021
rhsa
idRHSA-2020:1081
released2020-03-31
severityModerate
titleRHSA-2020:1081: net-snmp security and bug fix update (Moderate)
rpms
  • net-snmp-1:5.7.2-47.el7
  • net-snmp-agent-libs-1:5.7.2-47.el7
  • net-snmp-debuginfo-1:5.7.2-47.el7
  • net-snmp-devel-1:5.7.2-47.el7
  • net-snmp-gui-1:5.7.2-47.el7
  • net-snmp-libs-1:5.7.2-47.el7
  • net-snmp-perl-1:5.7.2-47.el7
  • net-snmp-python-1:5.7.2-47.el7
  • net-snmp-sysvinit-1:5.7.2-47.el7
  • net-snmp-utils-1:5.7.2-47.el7