CVE-2020-24361: 
Linux Debian vulnerability analysis and mitigation

SNMPTT (SNMP Trap Translator) before version 1.4.2 contained a security vulnerability identified as CVE-2020-24361. The vulnerability was discovered on August 16, 2020, affecting all versions prior to 1.4.2. This vulnerability allowed attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec functions (NVD, MITRE).

The vulnerability stemmed from two main issues: failure to properly drop privileges as configured and improper escaping of shell commands in certain functions. The vulnerability received a CVSS score of 7.5, indicating a high severity level. The issue specifically affected the EXEC, PREXEC, and unknown_trap_exec functionality within SNMPTT (SNMPTT Changelog, Gentoo Advisory).

The vulnerability could allow remote attackers to execute arbitrary shell code with the privileges of the process or cause a Denial of Service condition. This was particularly severe as the commands could be executed with elevated privileges instead of the intended restricted user permissions (Debian Advisory).

The vulnerability could be exploited remotely by sending a maliciously crafted SNMP trap to the affected system. The attack vector required no authentication, making it particularly dangerous for exposed systems (Gentoo Advisory).

The vulnerability was fixed in SNMPTT version 1.4.2. Users of affected versions were advised to upgrade to version 1.4.2 or later. The fix included proper privilege dropping and improved shell command escaping (SNMPTT Changelog).