CVE-2014-2285

net-snmp < 5.7.3 - Denial of Service via Empty Community String in SNMP Trap

Title source: llm
STIX 2.1

Description

The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.

References (11)

Core 11
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1072778
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-03/msg00060.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-03/msg00061.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59974
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-201409-02.xml
Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1072044
Various Sources mailing-list x_refsource_mlist
http://comments.gmane.org/gmane.comp.security.oss.general/12284
Vendor Advisory vendor-advisory x_refsource_redhat
https://rhn.redhat.com/errata/RHSA-2014-0322.html

Scores

EPSS 0.0331
EPSS Percentile 87.1%

Details

CWE
CWE-20
Status published
Products (1)
net-snmp/net-snmp < 5.7.3
Published Apr 27, 2014
Tracked Since Feb 18, 2026