Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 01 Sep 2014 10:53:37 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-3565, net-snmp: snmptrapd crash

Good morning,

CVE-2014-3565 was assigned to the following:

A remote denial-of-service flaw was found in the way snmptrapd handled
certain SNMP traps when started with the "-OQ" option. If an attacker
sent an SNMP trap containing a variable with a NULL type where an
integer variable type was expected, it would cause snmptrapd to crash.

http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/
https://bugzilla.redhat.com/show_bug.cgi?id=1125155

Upstream do not consider it a serious issue as very few people
use the "-OQ" option. It should be fixed in a new release due soon.

--
Murray McAllister / Red Hat Product Security

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.