Heap Buffer Overflow in NetX Duo SNMP Addon via BER Multibyte OID Length

Executive Summary

This vulnerability is in the NetX Duo SNMP addon. The function `_nx_snmp_utility_object_id_get` fails to validate the OID data length against the buffer size when using BER multibyte length encoding. A remote attacker can exploit this by sending a crafted SNMP packet with a multibyte OID length larger than the buffer, causing the parser to read past the packet boundary into adjacent heap memory. This leads to heap corruption as the out-of-bounds bytes are decoded and written into the agent's internal OID string buffer.

Useful 0 Not Useful 0

Impact Analysis

The impact depends on the system configuration. On systems with memory protection, the out-of-bounds read may crash the SNMP agent thread, causing a denial of service. On bare metal embedded systems without memory protection, the read may silently succeed and corrupt the agent's internal state with heap data, potentially leading to undefined behavior or further security issues.

Useful 0 Not Useful 0

Mitigation Strategies

Update or patch the NetX Duo SNMP addon to a version that validates OID data length against buffer size. If no patch is available, disable SNMP services or restrict network access to SNMP ports until a fix is applied.

Useful 0 Not Useful 0