CVE-2015-5621
First published: Thu Apr 16 2015(Updated: )
It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables in case the parsing of the SNMP PDU failed. If later processing tries to operate on the stale and incompletely processed varBind (e.g. when printing the variables), this can lead to e.g. crashes or, possibly, execution of arbitrary code (although I've only seen NULL pointer dereferences during my testing, I currently can't rule out code execution completely). The snmp_pdu_parse() function stores varBind variables in a list of netsnmp_variable_list structures. Each time the function parses a new varBind, a new netsnmp_variable_list item is allocated on the heap and linked to the list of variables. The problem is that this item is not removed from the list, even if snmp_pdu_parse() fails to complete the parsing. The "type" member of the stale netsnmp_variable_list is not properly initialized in case snmp_pdu_parse() returns early from the parsing. However, the "type" member is used to determine later code paths, which is why we see crashes in a variety of functions, although the root cause for all of these is the same. References: Upstream patch: <a href="https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/">https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</a> Upstream bug: <a href="https://sourceforge.net/p/net-snmp/bugs/2615/">https://sourceforge.net/p/net-snmp/bugs/2615/</a> (possibly restricted) Reporter's mail to oss-security: <a href="http://www.openwall.com/lists/oss-security/2015/04/13/1">http://www.openwall.com/lists/oss-security/2015/04/13/1</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/net-snmp | <=5.4.3~dfsg-1<=5.7.3+dfsg-1 | 5.7.3+dfsg-1.1 5.7.2.1+dfsg-1+deb8u1 |
| debian/net-snmp | 5.7.3+dfsg-5+deb10u2 5.7.3+dfsg-5+deb10u4 5.9+dfsg-4+deb11u1 5.9.3+dfsg-2 5.9.4+dfsg-1 | |
| CentOS Net-SNMP Agent Libraries | <=5.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2015-1636.html
- http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/
- http://support.citrix.com/article/CTX209443
- http://www.openwall.com/lists/oss-security/2015/04/13/1
- http://www.openwall.com/lists/oss-security/2015/04/16/15
- http://www.openwall.com/lists/oss-security/2015/07/31/1
- http://www.securityfocus.com/bid/76380
- http://www.securitytracker.com/id/1033304
- http://www.ubuntu.com/usn/USN-2711-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1212408
- https://cert-portal.siemens.com/productcert/pdf/ssa-978220.pdf
- https://sourceforge.net/p/net-snmp/bugs/2615/
- https://www.debian.org/security/2018/dsa-4154
- https://www.exploit-db.com/exploits/45547/
- https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/
- https://security-tracker.debian.org/tracker/CVE-2015-5621
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788964
- https://www.openwall.com/lists/oss-security/2015/04/13/1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1212412
- https://rhn.redhat.com/errata/RHSA-2015-1636.html
Frequently Asked Questions
What is the severity of CVE-2015-5621?
CVE-2015-5621 has a medium severity rating due to potential issues in processing SNMP PDUs.
How do I fix CVE-2015-5621?
To fix CVE-2015-5621, update your net-snmp package to version 5.7.3+dfsg-1.1 or later.
What systems are affected by CVE-2015-5621?
CVE-2015-5621 affects net-snmp versions up to 5.7.3+dfsg-1 and specific Debian package versions.
What are the potential impacts of CVE-2015-5621?
The impact of CVE-2015-5621 may include incomplete variable processing leading to application instability.
Is there a workaround for CVE-2015-5621 until I can apply a fix?
A temporary workaround for CVE-2015-5621 involves avoiding the use of affected net-snmp versions until they can be updated.
- collector/debian-bugs
- alias/CVE-2015-5621
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/net-snmp
- canonical/centos net-snmp agent libraries
- version/centos net-snmp agent libraries/5.7.2