The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0299 advisory.

    collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD     files (creating them if necessary). Because the daemon does not start up each time it updates files, it     has a low system footprint.

    Security Fix(es):

    * A double-free vulnerability was found in the csnmp_read_table function in the SNMP plugin of collectd. A     network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly     other impact. (CVE-2017-16820)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1605 advisory.

    Red Hat OpenStack Platform Operational Tools provides the facilities for monitoring a private or public     Red Hat OpenStack Platform cloud.

    collectd is a small C-language daemon, which reads various system metrics     periodically and updates RRD files (creating them if necessary). Because     the daemon does not start up each time it updates files, it has a low     system footprint.

    Security fix:

    * collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820)

    For more details about the security issue, including impact, a CVSS score, and other related information,     refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0252 advisory.

    collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD     files (creating them if necessary). Because the daemon does not start up each time it updates files, it     has a low system footprint.

    Security Fix(es):

    * The csnmp_read_table function in the SNMP plugin of collectd, before version 5.6.3, is susceptible to a     double free in a certain error case. This could lead to a crash. (CVE-2017-16820)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4793-1 advisory.

    It was discovered that collectd mishandled certain malformed packets. A remote attacker could use this     vulnerability to cause collectd to crash or possibly execute arbitrary code. (CVE-2016-6254)

    It was discovered that collectd failed to handle certain input. An attacker could use this vulnerability     to cause collectd to crash. (CVE-2017-16820)

    It was discovered that collectd mishandles certain malformed network packets. A remote attacker could use     this vulnerability to cause a Denial of Service or consume system resources. (CVE-2017-7401)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2615 advisory.

    collectd is a host-based system statistics collection daemon that gathers metrics from various sources     periodically, such as the operating system, applications, log files and devices, and storage clusters. As     the daemon does not start up each time it updates files, it has a low system footprint.

    For Red Hat Gluster Storage Web Administration 3.4, collectd service is responsible for gathering metrics     from Red Hat Gluster Storage clusters.

    The updated collectd package includes the following security bug fixes.

    Security Fix(es):

    * collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256()     functions (CVE-2017-7401)

    * collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    This updated package contains a number of bug fixes and enhancements, which are documented in detail in     the Release Notes, linked in the References.

    All users of collectd are advised to upgrade to these updated packages, which resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0560 advisory.

    collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD     files (creating them if necessary). Because the daemon does not start up each time it updates files, it     has a low system footprint.

    The following packages have been upgraded to a later upstream version: collectd (5.8.0). (BZ#1544653)

    Security Fix(es):

    * collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201803-10 (collectd: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Gentoo&rsquo;s collectd package.
      Please review the referenced CVE identifiers and bug entries for details.
  Impact :

    A local attacker, who either is already collectd&rsquo;s system user or       belongs to collectd&rsquo;s group, could potentially gain root privileges and       cause a Denial of Service condition.
    Remote attackers could cause a Denial of Service condition via specially       crafted SNMP responses.
  Workaround :

    There is no known workaround at this time.

Upstream released new version. See https://collectd.org/news.shtml#news106 for the list of changes.

Fixes CVE-2017-16820 (double free in snmp plugin)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Double free in csnmp_read_table function in snmp.c :

The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).
(CVE-2017-16820)

ID	Name	Product	Family	Severity
210318	RHEL 7 : collectd (RHSA-2018:0299)	Nessus	Red Hat Local Security Checks	critical
210305	RHEL 7 : collectd (RHSA-2018:1605)	Nessus	Red Hat Local Security Checks	critical
194037	RHEL 7 : collectd (RHSA-2018:0252)	Nessus	Red Hat Local Security Checks	critical
183566	Ubuntu 16.04 ESM : collectd vulnerabilities (USN-4793-1)	Nessus	Ubuntu Local Security Checks	critical
117321	RHEL 7 : collectd (RHSA-2018:2615)	Nessus	Red Hat Local Security Checks	critical
108683	RHEL 7 : collectd (RHSA-2018:0560)	Nessus	Red Hat Local Security Checks	critical
108525	GLSA-201803-10 : collectd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
106005	Fedora 27 : collectd (2017-f47206eae4)	Nessus	Fedora Local Security Checks	critical
105620	Amazon Linux AMI : collectd (ALAS-2018-940)	Nessus	Amazon Linux Local Security Checks	critical
105139	Fedora 26 : collectd (2017-f9cfcef9d6)	Nessus	Fedora Local Security Checks	critical
105137	Fedora 25 : collectd (2017-d7ab32cc23)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-16820

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical