Published: 19/08/2015 Updated: 10/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and previous versions does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
net-snmp net-snmp

Debian Bug report logs - #788964 net-snmp: CVE-2015-5621: snmp_pdu_parse() incompletely parsed varBinds left in list of variables Package: src:net-snmp; Maintainer for src:net-snmp is Net-SNMP Packaging Team <pkg-net-snmp-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 16 Ju ...

Net-SNMP could be made to crash or run programs if it received specially crafted network traffic ...

A heap corruption vulnerability was discovered in net-snmp, a suite of Simple Network Management Protocol applications, triggered when parsing the PDU prior to the authentication process A remote, unauthenticated attacker can take advantage of this flaw to crash the snmpd process (causing a denial of service) or, potentially, execute arbitrary cod ...

It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd (CVE-2015-5621) ...

It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd ...

It was discovered that in net-snmp before 58 the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables A remote, unauthenticated attacker could use this flaw to crash snmpd or potentially execute arbitrary code on the system with the privileges of the user running snmpd ...

Critical Infrastructure Sectors: Chemical, Energy, Food and Agriculture, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems

_ _ / | ___ ___| |_ ___ ___ ___ _____ ___ _ / / | | -_| _|___|_ -| | | | |_|_/ |_|_|___|_| |___|_|_|_|_|_| _| |_| 2018-10-08 NET-SNMP REMOTE DOS =================== Second bug is remotely exploitable only with knowledge of the community string (in this case "public ...

🐳 SNMP daemon Docker image based on Alpine Linux

⚠️ Abandoned project This project is not maintained anymore and is abandoned Feel free to fork and make your own changes if needed About 🐳 SNMP daemon (snmpd) Docker image based on Alpine Linux If you are interested, check out my other 🐳 Docker images! 💡 Want to be notified of new releases? Check out 🔔 Diun (Docker Image Update Notifier) project! Features SN

CWE-19 http://www.openwall.com/lists/oss-security/2015/04/13/1 http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/http://www.openwall.com/lists/oss-security/2015/07/31/1 http://www.ubuntu.com/usn/USN-2711-1 https://sourceforge.net/p/net-snmp/bugs/2615/http://rhn.redhat.com/errata/RHSA-2015-1636.html http://www.openwall.com/lists/oss-security/2015/04/16/15 https://bugzilla.redhat.com/show_bug.cgi?id=1212408 http://www.securityfocus.com/bid/76380 http://support.citrix.com/article/CTX209443 http://lists.opensuse.org/opensuse-updates/2015-09/msg00004.html http://www.securitytracker.com/id/1033304 https://www.debian.org/security/2018/dsa-4154 https://www.exploit-db.com/exploits/45547/https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788964 https://usn.ubuntu.com/2711-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/45547/https://www.cisa.gov/uscert/ics/advisories/icsa-20-042-02 https://access.redhat.com/security/cve/cve-2015-5621

CVE-2015-5621

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect