CVE-2014-3565

snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd crash) via a crafted SNMP trap message, which triggers a conversion to the variable type designated in the MIB file, as demonstrated by a NULL type in an ifMtu trap message.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Affected Products (NVD)
VendorProductVersion
applemac_os_x
10.11.0
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
15.04
net-snmpnet-snmp
𝑥
≤ 5.7.0
net-snmpnet-snmp
5.0
net-snmpnet-snmp
5.0.1
net-snmpnet-snmp
5.0.2
net-snmpnet-snmp
5.0.3
net-snmpnet-snmp
5.0.4
net-snmpnet-snmp
5.0.5
net-snmpnet-snmp
5.0.6
net-snmpnet-snmp
5.0.7
net-snmpnet-snmp
5.0.8
net-snmpnet-snmp
5.0.9
net-snmpnet-snmp
5.1
net-snmpnet-snmp
5.1.2
net-snmpnet-snmp
5.2
net-snmpnet-snmp
5.3
net-snmpnet-snmp
5.3.0.1
net-snmpnet-snmp
5.4
net-snmpnet-snmp
5.5
net-snmpnet-snmp
5.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
net-snmp
bookworm
5.9.3+dfsg-2
fixed
bullseye
5.9+dfsg-4+deb11u1
fixed
bullseye (security)
5.9+dfsg-4+deb11u1
fixed
sid
5.9.4+dfsg-1.1
fixed
squeeze
no-dsa
trixie
5.9.4+dfsg-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
net-snmp
lucid
ignored
precise
Fixed 5.4.3~dfsg-2.4ubuntu1.3
released
trusty
Fixed 5.7.2~dfsg-8.1ubuntu3.1
released
utopic
ignored
vivid
Fixed 5.7.2~dfsg-8.1ubuntu5.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsnmp30
suse enterprise sap 12 SP5
5.7.3-6.6.1
fixed
suse enterprise server 12 SP1
5.7.3-4.2
fixed
suse enterprise server 12 SP2
5.7.3-4.2
fixed
suse enterprise server 12 SP3
5.7.3-4.2
fixed
suse enterprise server 12 SP5
5.7.3-6.6.1
fixed
libsnmp30-32bit
suse enterprise sap 12 SP5
5.7.3-6.6.1
fixed
suse enterprise server 12 SP1
5.7.3-4.2
fixed
suse enterprise server 12 SP2
5.7.3-4.2
fixed
suse enterprise server 12 SP3
5.7.3-4.2
fixed
suse enterprise server 12 SP5
5.7.3-6.6.1
fixed
net-snmp
suse enterprise sap 12 SP5
5.7.3-6.6.1
fixed
suse enterprise server 12 SP1
5.7.3-4.2
fixed
suse enterprise server 12 SP2
5.7.3-4.2
fixed
suse enterprise server 12 SP3
5.7.3-4.2
fixed
suse enterprise server 12 SP5
5.7.3-6.6.1
fixed
perl-SNMP
suse enterprise sap 12 SP5
5.7.3-6.6.1
fixed
suse enterprise server 12 SP1
5.7.3-4.2
fixed
suse enterprise server 12 SP2
5.7.3-4.2
fixed
suse enterprise server 12 SP3
5.7.3-4.2
fixed
suse enterprise server 12 SP5
5.7.3-6.6.1
fixed
snmp-mibs
suse enterprise sap 12 SP5
5.7.3-6.6.1
fixed
suse enterprise server 12 SP1
5.7.3-4.2
fixed
suse enterprise server 12 SP2
5.7.3-4.2
fixed
suse enterprise server 12 SP3
5.7.3-4.2
fixed
suse enterprise server 12 SP5
5.7.3-6.6.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
net-snmp
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-agent-libs
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-devel
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-gui
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-libs
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-perl
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-python
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-sysvinit
RHEL 7
1:5.7.2-24.el7
fixed
net-snmp-utils
RHEL 6
1:5.5-54.el6
fixed
RHEL 7
1:5.7.2-24.el7
fixed
Common Weakness Enumeration
References
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00013.html
http://rhn.redhat.com/errata/RHSA-2015-1385.html
http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/
http://sourceforge.net/p/net-snmp/official-patches/48/
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/69477
http://www.ubuntu.com/usn/USN-2711-1
https://bugzilla.redhat.com/show_bug.cgi?id=1125155
https://security.gentoo.org/glsa/201507-17
https://support.apple.com/HT205375
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00013.html
http://rhn.redhat.com/errata/RHSA-2015-1385.html
http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/
http://sourceforge.net/p/net-snmp/official-patches/48/
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/69477
http://www.ubuntu.com/usn/USN-2711-1
https://bugzilla.redhat.com/show_bug.cgi?id=1125155
https://security.gentoo.org/glsa/201507-17
https://support.apple.com/HT205375