CVE-2015-5621

High

Published: 19/08/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The snmp_pdu_parse function in net-snmp version 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

Risk Assessment

The organization may be exposed to attacks that lead to system crashes and potential execution of malicious code, which could result in data loss or security breaches.

Recommendation

It is recommended to upgrade to the latest version of net-snmp to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Other vulnerabilities in net-snmp

CVE-2008-4309High
Heap buffer overflow in the netsnmp_create_subtree_cache function in net-snmp before version 5.4.2.1, 5.3.2.3, and 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request.

Original NVD description (English source)

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.