Description
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
net-snmp Net-SNMP
Default version status: unaffected
0 to ≤ 5.9.5.2affected
pkg:github/net-snmp/net-snmpReferences
- https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb ↗
- https://github.com/net-snmp/net-snmp/blob/v5.9.5.2/agent/mibgroup/smux/smux.c ↗
- https://github.com/net-snmp/net-snmp ↗
- https://www.vulncheck.com/advisories/net-snmp-through-5.9.5.2-denial-of-service-via-blocking-unauthenticated-smux-read ↗