NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.

It was discovered that the snmppduparse() function could leave incompletely parsed varBind variables in the list of variables in case the parsing of the SNMP PDU failed. If later processing tries to operate on the stale and incompletely processed varBind (e.g. when printing the variables), this can lead to e.g. crashes or, possibly, execution of arbitrary code (although I've only seen NULL pointer dereferences during my testing, I currently can't rule out code execution completely).

The snmppduparse() function stores varBind variables in a list of netsnmpvariablelist structures. Each time the function parses a new varBind, a new netsnmpvariablelist item is allocated on the heap and linked to the list of variables. The problem is that this item is not removed from the list, even if snmppduparse() fails to complete the parsing.

The "type" member of the stale netsnmpvariablelist is not properly initialized in case snmppduparse() returns early from the parsing. However, the "type" member is used to determine later code paths, which is why we see crashes in a variety of functions, although the root cause for all of these is the same.

References:

Upstream patch: https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/

Upstream bug: https://sourceforge.net/p/net-snmp/bugs/2615/ (possibly restricted)

Reporter's mail to oss-security: http://www.openwall.com/lists/oss-security/2015/04/13/1

The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.