The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the snmp_pdu_parse() mishandles     error codes and is vulnerable to a heap corruption     within the parsing of the PDU prior to the     authentication process. A remote, unauthenticated     attacker could use this flaw to crash snmpd or,     potentially, execute arbitrary code on the system with     the privileges of the user running     snmpd.(CVE-2018-1000116)

  - snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP     before 5.8 has a NULL Pointer Exception bug that can be     used by an unauthenticated attacker to remotely cause     the instance to crash via a crafted UDP packet,     resulting in Denial of Service.(CVE-2018-18066)

  - It was discovered that the snmp_pdu_parse() function     could leave incompletely parsed varBind variables in     the list of variables. A remote, unauthenticated     attacker could use this flaw to crash snmpd or,     potentially, execute arbitrary code on the system with     the privileges of the user running     snmpd.(CVE-2015-5621)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap corruption vulnerability was discovered in net-snmp, a suite of Simple Network Management Protocol applications, triggered when parsing the PDU prior to the authentication process. A remote, unauthenticated attacker can take advantage of this flaw to crash the snmpd process (causing a denial of service) or, potentially, execute arbitrary code with the privileges of the user running snmpd.

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. (CVE-2015-5621)

The following issues have been fixed within this update :

  - fix btrfs output inside     HOST-RESOURCES-MIB::hrStorageDescr. (bsc#909479)

  - fix an incompletely initialized vulnerability within the     snmp_pdu_parse() function of snmp_api.c. (bsc#940188,     CVE-2015-5621)

  - add build requirement 'procps' to fix a net-snmp-config     error (bsc#935863)

  - --disable-md5 to allow operation in FIPS mode and not     use the old algorithm (bsc#935876 bsc#940084)

  - also stop snmptrapd on removal

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

net-snmp was updated to fix one security vulnerability and several bugs.

  - fix a vulnerability within the snmp_pdu_parse() function     of snmp_api.c. (bnc#940188, CVE-2015-5621)

  - Add build requirement 'procps' to fix a net-snmp-config     error. (bsc#935863)

  - add support for /dev/shm in snmp hostmib (bnc#853382,     FATE#316893).

  - stop snmptrapd on package removal.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

net-snmp was updated to fix one secuirty vulnerability and 2 bugs.

  - Fix an incompletely initialized vulnerability within the     snmp_pdu_parse() function of snmp_api.c. (bnc#940188,     CVE-2015-5621)

  - Add build requirement 'procps' to fix a net-snmp-config     error. (bsc#935863)

  - Stop snmptrapd on removal.

It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd. (CVE-2015-5621)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2711-1 advisory.

    It was discovered that Net-SNMP incorrectly handled certain trap messages when the -OQ option was used. A     remote attacker could use this issue to cause Net-SNMP to crash, resulting in a denial of service.
    (CVE-2014-3565)

    Qinghao Tang discovered that Net-SNMP incorrectly handled SNMP PDU parsing failures. A remote attacker     could use this issue to cause Net-SNMP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5621)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated net-snmp packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

It was discovered that the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system with the privileges of the user running snmpd. (CVE-2015-5621)

Red Hat would like to thank Qinghao Tang of QIHU 360 company, China for reporting this issue.

All net-snmp users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1636 advisory.

    [1:5.5-54.0.1.el6_7.1]
    - Add Oracle ACFS to hrStorage (John Haxby) [orabug 18510373]

    [1:5.5-54.el6_7.1]
    - Fixed parsing of invalid variables in incoming packets (#1248410)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Qinghao Tang reports :

Incompletely initialized vulnerability exists in the function 'snmp_pdu_parse()' of 'snmp_api.c', and remote attackers can cause memory leak, DOS and possible command executions by sending malicious packets.

ID	Name	Product	Family	Severity
124939	EulerOS Virtualization 3.0.1.0 : net-snmp (EulerOS-SA-2019-1436)	Nessus	Huawei Local Security Checks	critical
108696	Debian DSA-4154-1 : net-snmp - security update	Nessus	Debian Local Security Checks	critical
87902	F5 Networks BIG-IP : SNMP vulnerability (K17378)	Nessus	F5 Networks Local Security Checks	high
85942	SUSE SLED12 / SLES12 Security Update : net-snmp (SUSE-SU-2015:1556-1)	Nessus	SuSE Local Security Checks	high
85903	SUSE SLED11 / SLES11 Security Update : net-snmp (SUSE-SU-2015:1524-1)	Nessus	SuSE Local Security Checks	high
85837	openSUSE Security Update : net-snmp (openSUSE-2015-568)	Nessus	SuSE Local Security Checks	high
85748	Amazon Linux AMI : net-snmp (ALAS-2015-590)	Nessus	Amazon Linux Local Security Checks	high
85506	Ubuntu 14.04 LTS : Net-SNMP vulnerabilities (USN-2711-1)	Nessus	Ubuntu Local Security Checks	medium
85500	Scientific Linux Security Update : net-snmp on SL6.x, SL7.x i386/x86_64 (20150817)	Nessus	Scientific Linux Local Security Checks	high
85497	RHEL 6 / 7 : net-snmp (RHSA-2015:1636)	Nessus	Red Hat Local Security Checks	critical
85492	Oracle Linux 6 / 7 : net-snmp (ELSA-2015-1636)	Nessus	Oracle Linux Local Security Checks	medium
85464	CentOS 6 / 7 : net-snmp (CESA-2015:1636)	Nessus	CentOS Local Security Checks	critical
85172	FreeBSD : net-snmp -- snmp_pdu_parse() function incomplete initialization (381183e8-3798-11e5-9970-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-5621

medium

Tenable Plugins

critical

critical

high

high

high

high

high

medium

high

critical

medium

critical

high