CVE-2022-24809: Protecting Your Network from Unsafe SNMP Access using net-snmp

The CVE-2022-24809 vulnerability is an important security issue in the net-snmp software suite, which provides a widely-used set of tools for implementing the Simple Network Management Protocol (SNMP). It has recently come to light that certain configurations of net-snmp prior to version 5.9.2 can allow an attacker to exploit this vulnerability. This post aims to provide detailed information on the issue and how to fix it, including code snippets, links to original references, and an explanation of how the exploit works.

Code Snippet

In the vulnerable version of net-snmp, a user with read-only access can cause a NULL pointer dereference by using a malformed OID in a GET-NEXT request to the nsVacmAccessTable. Here's an example of how the problematic request might look like:

snmpgetnext -v 2c -c public 192.168..1 .1.3.6.1.6.3.16.1.5.2.1.10.malformed_oid

Exploit Details

The CVE-2022-24809 vulnerability allows a user with read-only credentials to manipulate the nsVacmAccessTable, which should not be allowed. The issue occurs when a malformed OID is used in a GET-NEXT request, resulting in a NULL pointer dereference. This vulnerability can be exploited to compromise the availability of the SNMP service, potentially leading to a Denial of Service (DoS) attack.

For more information on the vulnerability and the patch, consult the following original sources

1. The official net-snmp repository, which contains the patch: https://github.com/net-snmp/net-snmp/commit/c3aeeea24a8d5c2fda3145e3d69a2f8a6946c66
2. The CVE details page for CVE-2022-24809: https://nvd.nist.gov/vuln/detail/CVE-2022-24809
3. net-snmp's official documentation: http://www.net-snmp.org/

How to Fix the Issue

If you are using a version of net-snmp prior to 5.9.2, it's crucial to update to the latest version to protect your network from potential attacks. To update, follow the instructions on the net-snmp GitHub repository: https://github.com/net-snmp/net-snmp/releases

Additionally, users should adhere to the following best practices for securing SNMP access

1. Always use strong SNMPv3 credentials: Avoid using weak authentication protocols like SNMPv1 or SNMPv2c.

Do not share credentials with unauthorized users.

3. If you must use SNMPv1 or SNMPv2c, use a complex community string and limit the access to a specific IP address range to mitigate the risk of unauthorized access.

By following these steps and upgrading your net-snmp installation to version 5.9.2 or later, you can greatly reduce the risk of attackers exploiting the CVE-2022-24809 vulnerability and protect your network from potential threats.

Timeline

Published on: 04/16/2024 20:15:09 UTC