Vulnerability CVE-2020-24361: Information

Description

SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.

Severity: CRITICAL (9.8)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: HIGH (7.5)

Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-24361

Published: Aug. 16, 2020

Modified: Nov. 21, 2024

Error type identifier: CWE-273

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
snmptt	sisyphus	1.4.2-alt1	1.5-alt1	ALT-PU-2020-3129-1	260492	Fixed
snmptt	p11	1.4.2-alt1	1.4.2-alt1	ALT-PU-2020-3129-1	260492	Fixed
snmptt	p10	1.4.2-alt1	1.4.2-alt1	ALT-PU-2020-3129-1	260492	Fixed
snmptt	p9	1.4.2-alt1	1.4.2-alt1	ALT-PU-2020-3174-1	260493	Fixed
snmptt	c10f2	1.4.2-alt1	1.4.2-alt1	ALT-PU-2020-3129-1	260492	Fixed
snmptt	c9f2	1.4.2-alt1	1.4.2-alt1	ALT-PU-2024-3798-3	342504	Fixed

Hyperlink	Resource
http://www.snmptt.org/changelog.shtml	Release Notes Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00006.html	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202007-63	Third Party Advisory
BDU:2021-03734

Affected configurations:
1. cpe:2.3:a:snmptt:snmptt:*:*:*:*:*:*:*:*
  End excluding
  1.4.2
  cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Version: v26.2.2