CVE-2014-2310: Input Validation
It was reported [1],[2]that the AgentX subagent of net-snmp could be stalled when a manager sent a multi-object request with a different number subids. This could lead to a denial of service.
This has been corrected upstream in version 5.4.4 [3]; only earlier versiona are affected. This means that Fedora and Red Hat Enterprise Linux 6 are not affected, however Red Hat Enterprise Linux 5 does ship a vulnerable version (5.3.x).
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388 [2] http://seclists.org/oss-sec/2014/q1/513 [3] http://sourceforge.net/p/net-snmp/patches/1113/
Statement:
This issue did not affect the version of the net-snmp packages as shipped with Red Hat Enterprise Linux 6.
Other sources
The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/net-snmpto a version that resolves this vulnerability.Fixed in 5.4.4 - Upgrade
Upgrade
debian/net-snmpto a version that resolves this vulnerability.Fixed in 5.9+dfsg-4+deb11u1Fixed in 5.9.3+dfsg-2Fixed in 5.9.4+dfsg-2 - Upgrade
Upgrade
net-snmp AgentX subagentto a version that resolves this vulnerability.Fixed in 5.4.4 - Upgrade
Upgrade
net-snmp (Red Hat Enterprise Linux 5 ships 5.3.x)to a version that resolves this vulnerability.Fixed in 5.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2310?
CVE-2014-2310 is classified as a denial of service vulnerability.
How do I fix CVE-2014-2310?
To fix CVE-2014-2310, upgrade net-snmp to version 5.4.4 or later for Red Hat systems or to versions 5.9+dfsg-4+deb11u1, 5.9.3+dfsg-2, or 5.9.4+dfsg-1.1 for Debian systems.
Which versions of net-snmp are affected by CVE-2014-2310?
Versions of net-snmp earlier than 5.4.4 are affected by CVE-2014-2310.
What types of systems are vulnerable to CVE-2014-2310?
CVE-2014-2310 affects systems running earlier versions of net-snmp on both Red Hat and Debian distributions.
Is there a known exploit for CVE-2014-2310?
Yes, CVE-2014-2310 can be exploited to create a denial of service condition by sending malformed multi-object requests.