Bug 940188 (CVE-2015-5621) - VUL-0: CVE-2015-5621: net-snmp: snmp_pdu_parse() incompletely parsed varBinds left in list of variables
Summary: VUL-0: CVE-2015-5621: net-snmp: snmp_pdu_parse() incompletely parsed varBinds...
Status: RESOLVED FIXED
Alias: CVE-2015-5621
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-08-27
Assignee: Alexander Bergmann
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/119342/
Whiteboard: maint:released:sle10-sp3:62263
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-31 11:47 UTC by Johannes Segitz
Modified: 2017-03-21 18:02 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-07-31 11:47:18 UTC 
rh#1212408

Discovered by Qinghao Tang

Incompletely initialized vulnerability exists in the function
‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
leak, DOS and possible command executions by sending malicious packets.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1212408
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5621
http://seclists.org/oss-sec/2015/q3/260
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5621
Comment 1 Johannes Segitz 2015-07-31 11:47:37 UTC 
Seems like SLE 10 SP3 to SLE 12 is affected
Comment 2 Swamp Workflow Management 2015-07-31 11:52:59 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-08-14.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62240
Comment 3 Swamp Workflow Management 2015-07-31 22:00:16 UTC 
bugbot adjusting priority
Comment 4 Sebastian Krahmer 2015-08-11 11:23:07 UTC 
what are we up to here?
Comment 5 Swamp Workflow Management 2015-08-13 16:05:24 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-08-27.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62262
Comment 8 Bernhard Wiedemann 2015-08-14 10:00:15 UTC 
This is an autogenerated message for OBS integration:
This bug (940188) was mentioned in
https://build.opensuse.org/request/show/323040 Factory / net-snmp
https://build.opensuse.org/request/show/323058 13.1 / net-snmp
https://build.opensuse.org/request/show/323059 13.2 / net-snmp
Comment 10 Swamp Workflow Management 2015-09-07 06:10:35 UTC 
openSUSE-SU-2015:1502-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 935863,940188
CVE References: CVE-2015-5621
Sources used:
openSUSE 13.2 (src):    net-snmp-5.7.3-3.1
openSUSE 13.1 (src):    net-snmp-5.7.2-9.11.1
Comment 11 Swamp Workflow Management 2015-09-09 17:11:05 UTC 
SUSE-SU-2015:1524-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (moderate)
Bug References: 853382,935863,940188
CVE References: CVE-2015-5621
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Server 11-SP4 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Server 11-SP3 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    net-snmp-5.4.2.1-8.12.24.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    net-snmp-5.4.2.1-8.12.24.1
Comment 12 Swamp Workflow Management 2015-09-14 15:11:12 UTC 
SUSE-SU-2015:1556-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (moderate)
Bug References: 909479,935863,935876,940084,940188
CVE References: CVE-2015-5621
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    net-snmp-5.7.2.1-4.3.2
SUSE Linux Enterprise Server 12 (src):    net-snmp-5.7.2.1-4.3.2
SUSE Linux Enterprise Desktop 12 (src):    net-snmp-5.7.2.1-4.3.2
Comment 13 Alexander Bergmann 2016-04-22 09:36:50 UTC 
Fixed and released. Closing bug.