CVE-2001-0236: Solaris snmpXdmid SNMP-to-DMI mapper buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 10.0 with network reachability, no authentication and full impact, plus very high EPSS, makes this a top remediation priority despite its age.

What it is

The snmpXdmid daemon in Solaris and SunOS contains a buffer overflow that can be triggered by a long "indication" event. Because the daemon maps SNMP requests to DMI, a remote unauthenticated attacker can corrupt memory and potentially run arbitrary commands. The flaw is severe but the record is old and lacks modern detail.

Impact

An attacker can execute arbitrary commands with the privileges of the snmpXdmid daemon, which typically runs as root, leading to full compromise of the host. No confidentiality, integrity or availability impact is excluded by the CVSS vector.

Attack surface

Reachable over the network via SNMP traffic to the snmpXdmid service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The description does not specify the exact port or protocol version, so defenders should confirm the listening service on their systems.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.72036 (99.4th percentile), indicating a high modeled likelihood of exploitation. Reference tags include Patch and Vendor Advisory, so a fix exists but no public exploit details are given in this record.

What to do

• Apply the Sun/Solaris patch referenced in the CERT CA-2001-05 advisory and Sun security bulletin 207.
• Disable or stop the snmpXdmid daemon if SNMP-to-DMI mapping is not required.
• Restrict SNMP access to trusted management hosts using host-based firewalls or tcp_wrappers.
• Monitor for and block unexpected SNMP traffic from untrusted networks.
• Upgrade to a supported Solaris release if the system is still running an affected version.

Detection

• Look for snmpXdmid crashes, core dumps or restarts in system logs.
• Monitor SNMP traffic for unusually long or malformed indication events.
• Alert on unexpected outbound connections or process creation from the snmpXdmid process.
• Audit which hosts expose the SNMP-to-DMI mapper service and review firewall rules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.