ALAS-2012-097


Amazon Linux AMI Security Advisory: ALAS-2012-97
Advisory Release Date: 2014-09-14 16:31 Pacific
Severity: Medium

Issue Overview:

An array index error, leading to an out-of-bounds buffer read flaw, was found in the way the net-snmp agent looked up entries in the extension table. A remote attacker with read privileges to a Management Information Base (MIB) subtree handled by the "extend" directive (in "/etc/snmp/snmpd.conf") could use this flaw to crash snmpd via a crafted SNMP GET request. (CVE-2012-2141 )


Affected Packages:

net-snmp


Issue Correction:
Run yum update net-snmp to update your system.

New Packages:
i686:
    net-snmp-perl-5.5-41.10.amzn1.i686
    net-snmp-utils-5.5-41.10.amzn1.i686
    net-snmp-libs-5.5-41.10.amzn1.i686
    net-snmp-python-5.5-41.10.amzn1.i686
    net-snmp-debuginfo-5.5-41.10.amzn1.i686
    net-snmp-devel-5.5-41.10.amzn1.i686
    net-snmp-5.5-41.10.amzn1.i686

src:
    net-snmp-5.5-41.10.amzn1.src

x86_64:
    net-snmp-python-5.5-41.10.amzn1.x86_64
    net-snmp-5.5-41.10.amzn1.x86_64
    net-snmp-debuginfo-5.5-41.10.amzn1.x86_64
    net-snmp-libs-5.5-41.10.amzn1.x86_64
    net-snmp-devel-5.5-41.10.amzn1.x86_64
    net-snmp-perl-5.5-41.10.amzn1.x86_64
    net-snmp-utils-5.5-41.10.amzn1.x86_64