Bug 509110 – <net-analyzer/net-snmp-5.7.3_pre3: Denial of Service (CVE-2014-2285)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2014-04-29 21:30:22 UTC]

CVE-2014-2285 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2285):
  The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in
  Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows
  remote attackers to cause a denial of service (snmptrapd crash) via an empty
  community string in an SNMP trap, which triggers a NULL pointer dereference
  within the newSVpv function in Perl.

[Comment 1 Jeroen Roovers (RETIRED) 2014-04-30 05:04:40 UTC]

Arch teams, please test and mark stable:
=net-analyzer/net-snmp-5.7.3_pre3
Targeted stable KEYWORDS : alpha amd64 arm hppa ia64 ppc ppc64 sparc x86

[Comment 2 Agostino Sarubbo 2014-04-30 13:59:49 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2014-04-30 14:21:23 UTC]

x86 stable

[Comment 4 Jeroen Roovers (RETIRED) 2014-04-30 14:28:31 UTC]

Stable for HPPA.

[Comment 5 Markus Meier 2014-05-03 14:19:53 UTC]

arm stable

[Comment 6 Agostino Sarubbo 2014-05-10 14:02:34 UTC]

ppc stable

[Comment 7 Agostino Sarubbo 2014-05-11 08:05:52 UTC]

ppc64 stable

[Comment 8 Agostino Sarubbo 2014-05-13 15:21:52 UTC]

ia64 stable

[Comment 9 Agostino Sarubbo 2014-05-14 16:12:01 UTC]

sparc stable

[Comment 10 Agostino Sarubbo 2014-05-17 13:51:09 UTC]

alpha stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 11 Yury German 2014-05-20 04:03:00 UTC]

Arches and Maintainer(s), Thank you for your work!

Security please Vote!

[Comment 12 Sean Amoss (RETIRED) 2014-06-01 18:09:08 UTC]

Adding to existing GLSA draft.

[Comment 13 GLSAMaker/CVETool Bot 2014-09-01 21:49:59 UTC]

This issue was resolved and addressed in
 GLSA 201409-02 at http://security.gentoo.org/glsa/glsa-201409-02.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).