CVE-2014-2285: Input Validation
A remote denial-of-Service flaw was found in the way snmptrapd handled trap requests with empty community string, when the perl handler was enabled. A remote attacker could use this flaw to cause snmp to crash.
More details about the flaw is available at: https://bugzilla.redhat.com/showbug.cgi?id=1072044
Proposed upstream patch: http://sourceforge.net/p/net-snmp/patches/1275/
Other sources
The perltrapdhandler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2285?
CVE-2014-2285 is classified as a high severity denial-of-service vulnerability.
How does CVE-2014-2285 affect my system?
CVE-2014-2285 can cause snmptrapd to crash when it processes trap requests with an empty community string.
How do I fix CVE-2014-2285?
To fix CVE-2014-2285, upgrade to a version of Net-SNMP newer than 5.7.3 where this vulnerability is addressed.
Which versions of Net-SNMP are vulnerable to CVE-2014-2285?
Net-SNMP versions up to and including 5.7.3 are vulnerable to CVE-2014-2285.
Is there a workaround for CVE-2014-2285?
A potential workaround for CVE-2014-2285 is to disable the perl handler in snmptrapd configuration.