The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.

According to the version of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The perl_trapd_handler function in     perl/TrapReceiver/TrapReceiver.xs in Net-SNMP     5.7.3.pre3 and earlier, when using certain Perl     versions, allows remote attackers to cause a denial of     service (snmptrapd crash) via an empty community string     in an SNMP trap, which triggers a NULL pointer     dereference within the newSVpv function in     Perl.(CVE-2014-2285)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated net-snmp packages fix security vulnerabilities :

Remotely exploitable denial of service vulnerability in Net-SNMP, in the Linux implementation of the ICMP-MIB, making the SNMP agent vulnerable if it is making use of the ICMP-MIB table objects (CVE-2014-2284).

Remotely exploitable denial of service vulnerability in Net-SNMP, in snmptrapd, due to how it handles trap requests with an empty community string when the perl handler is enabled (CVE-2014-2285).

A remote denial-of-service flaw was found in the way snmptrapd handled certain SNMP traps when started with the -OQ option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash (CVE-2014-3565).

The remote Solaris system is missing necessary patches to address security updates :

  - The perl_trapd_handler function in     perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3     and earlier, when using certain Perl versions, allows     remote attackers to cause a denial of service (snmptrapd     crash) via an empty community string in an SNMP trap,     which triggers a NULL pointer dereference within the     newSVpv function in Perl. (CVE-2014-2285)

  - snmplib/mib.c in net-snmp 5.7.0 and earlier, when the

    -OQ option is used, allows remote attackers to cause a     denial of service (snmptrapd crash) via a crafted SNMP     trap message, which triggers a conversion to the     variable type designated in the MIB file, as     demonstrated by a NULL type in an ifMtu trap message.
    (CVE-2014-3565)

The remote host is affected by the vulnerability described in GLSA-201409-02 (Net-SNMP: Denial of Service)

    Multiple vulnerabilities have been discovered in Net-SNMP. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could create a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

net-snmp was updated to fix potential remote denial of service problems :

  - fixed a potential remote denial of service problem     within the Linux ICMP-MIB implementation     (CVE-2014-2284)(bnc#866942)

  - fixed a potential remote denial of service problem     inside the snmptrapd Perl trap handler     (CVE-2014-2285)(bnc#866942)

Ken Farnen discovered that Net-SNMP incorrectly handled AgentX timeouts. A remote attacker could use this issue to cause the server to crash or to hang, resulting in a denial of service. (CVE-2012-6151)

It was discovered that the Net-SNMP ICMP-MIB incorrectly validated input. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 13.10. (CVE-2014-2284)

Viliam Pucik discovered that the Net-SNMP perl trap handler incorrectly handled NULL arguments. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service.
(CVE-2014-2285)

It was discovered that Net-SNMP incorrectly handled AgentX multi-object requests. A remote attacker could use this issue to cause the server to hang, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 12.10.
(CVE-2014-2310).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The net-snmp remote service received security and bugfixes :

  - A remote denial of service flaw in Linux implementation     of ICMP-MIB has been fixed. (CVE-2014-2284)

  - snmptrapd could have crashed when using a trap with     empty community string. This has been fixed.
    (CVE-2014-2285)

  - The AgentX subagent of net-snmp could have been stalled     when a manager sent a multi-object request with a     different number of subids. (CVE-2014-2310)

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151)

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp- perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285)

After installing this update, the snmpd and snmptrapd services will be restarted automatically.

Updated net-snmp packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151)

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp-perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285)

All net-snmp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the snmpd and snmptrapd services will be restarted automatically.

From Red Hat Security Advisory 2014:0322 :

Updated net-snmp packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151)

A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp-perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285)

All net-snmp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the snmpd and snmptrapd services will be restarted automatically.

ID	Name	Product	Family	Severity
137463	EulerOS 2.0 SP2 : net-snmp (EulerOS-SA-2020-1621)	Nessus	Huawei Local Security Checks	medium
82345	Mandriva Linux Security Advisory : net-snmp (MDVSA-2015:092)	Nessus	Mandriva Local Security Checks	medium
80708	Oracle Solaris Third-Party Patch Update : net-snmp (cve_2012_2141_denial_of)	Nessus	Solaris Local Security Checks	medium
77471	GLSA-201409-02 : Net-SNMP: Denial of Service	Nessus	Gentoo Local Security Checks	medium
75300	openSUSE Security Update : net-snmp (openSUSE-SU-2014:0398-1)	Nessus	SuSE Local Security Checks	medium
73513	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : net-snmp vulnerabilities (USN-2166-1)	Nessus	Ubuntu Local Security Checks	medium
73511	SuSE 11.3 Security Update : net-snmp (SAT Patch Number 9015)	Nessus	SuSE Local Security Checks	medium
73176	Scientific Linux Security Update : net-snmp on SL5.x i386/x86_64 (20140324)	Nessus	Scientific Linux Local Security Checks	medium
73175	RHEL 5 : net-snmp (RHSA-2014:0322)	Nessus	Red Hat Local Security Checks	medium
73173	Oracle Linux 5 : net-snmp (ELSA-2014-0322)	Nessus	Oracle Linux Local Security Checks	medium
73163	CentOS 5 : net-snmp (CESA-2014:0322)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2014-2285

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium