CVE-2004-2300 - Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local use

CVE-2004-2300

Summary

Buffer overflow in snmpd in ucd-snmp 4.2.6 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -p command line argument. NOTE: it is not clear whether there are any standard configurations in which snmpd is installed setuid or setgid. If not, then this issue should not be included in CVE.

References

Vulnerable Configurations

cpe:2.3:a:ucd-snmp:ucd-snmp:*:*:*:*:*:*:*:*
cpe:2.3:a:ucd-snmp:ucd-snmp:*:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 11-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	10396
misc	http://www.packetstormsecurity.org/0405-advisories/snmpdadv.txt
xf	ucd-snmpd-command-bo(16245)

statements via4

contributor	Mark J Cox
lastmodified	2006-08-30
organization	Red Hat
statement	Not vulnerable. We did not ship snmpd setuid root in Red Hat Enterprise Linux 2.1, 3, or 4.

Last major update

11-07-2017 - 01:31

Published

31-12-2004 - 05:00

Last modified

11-07-2017 - 01:31