CVE-2017-7401

High

Published: 03/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with 'SecurityLevel None' and with empty 'AuthFile' options) via a crafted UDP packet.

Risk Assessment

Attackers can exploit this vulnerability to disrupt the operation of a collectd instance, potentially leading to downtime in monitoring systems and services within the organization.

Recommendation

It is recommended to update collectd to version 5.7.2 or later and to configure appropriate security options to minimize risk.

Other vulnerabilities in collectd

CVE-2016-6254Critical
Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

Original NVD description (English source)

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.