Security update for net-snmp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1556-1 Final 1 1 2015-08-21T13:10:58Z current 2015-08-21T13:10:58Z 2015-08-21T13:10:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for net-snmp The following issues have been fixed within this update: * fix btrfs output inside HOST-RESOURCES-MIB::hrStorageDescr. (bsc#909479) * fix an incompletely initialized vulnerability within the snmp_pdu_parse() function of snmp_api.c. (bsc#940188, CVE-2015-5621) * add build requirement 'procps' to fix a net-snmp-config error (bsc#935863) * --disable-md5 to allow operation in FIPS mode and not use the old algorithm (bsc#935876 bsc#940084) * also stop snmptrapd on removal The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-537,SUSE-SLE-SDK-12-2015-537,SUSE-SLE-SERVER-12-2015-537 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151556-1/ Link for SUSE-SU-2015:1556-1 https://lists.suse.com/pipermail/sle-security-updates/2015-September/001593.html E-Mail link for SUSE-SU-2015:1556-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/909479 SUSE Bug 909479 https://bugzilla.suse.com/935863 SUSE Bug 935863 https://bugzilla.suse.com/935876 SUSE Bug 935876 https://bugzilla.suse.com/940084 SUSE Bug 940084 https://bugzilla.suse.com/940188 SUSE Bug 940188 https://www.suse.com/security/cve/CVE-2015-5621/ SUSE CVE CVE-2015-5621 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libsnmp30-5.7.2.1-4.3.2 libsnmp30-32bit-5.7.2.1-4.3.2 net-snmp-5.7.2.1-4.3.2 perl-SNMP-5.7.2.1-4.3.2 snmp-mibs-5.7.2.1-4.3.2 net-snmp-devel-5.7.2.1-4.3.2 libsnmp30-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 libsnmp30-32bit-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 net-snmp-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 perl-SNMP-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 snmp-mibs-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Desktop 12 libsnmp30-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 libsnmp30-32bit-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 net-snmp-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 perl-SNMP-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 snmp-mibs-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server 12 libsnmp30-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libsnmp30-32bit-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 net-snmp-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 perl-SNMP-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 snmp-mibs-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 net-snmp-devel-5.7.2.1-4.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. CVE-2015-5621 SUSE Linux Enterprise Desktop 12:libsnmp30-32bit-5.7.2.1-4.3.2 SUSE Linux Enterprise Desktop 12:libsnmp30-5.7.2.1-4.3.2 SUSE Linux Enterprise Desktop 12:net-snmp-5.7.2.1-4.3.2 SUSE Linux Enterprise Desktop 12:perl-SNMP-5.7.2.1-4.3.2 SUSE Linux Enterprise Desktop 12:snmp-mibs-5.7.2.1-4.3.2 SUSE Linux Enterprise Server 12:libsnmp30-32bit-5.7.2.1-4.3.2 SUSE Linux Enterprise Server 12:libsnmp30-5.7.2.1-4.3.2 SUSE Linux Enterprise Server 12:net-snmp-5.7.2.1-4.3.2 SUSE Linux Enterprise Server 12:perl-SNMP-5.7.2.1-4.3.2 SUSE Linux Enterprise Server 12:snmp-mibs-5.7.2.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12:libsnmp30-32bit-5.7.2.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12:libsnmp30-5.7.2.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12:net-snmp-5.7.2.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12:perl-SNMP-5.7.2.1-4.3.2 SUSE Linux Enterprise Server for SAP Applications 12:snmp-mibs-5.7.2.1-4.3.2 SUSE Linux Enterprise Software Development Kit 12:net-snmp-devel-5.7.2.1-4.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151556-1/ https://www.suse.com/security/cve/CVE-2015-5621.html CVE-2015-5621 https://bugzilla.suse.com/1111123 SUSE Bug 1111123 https://bugzilla.suse.com/940188 SUSE Bug 940188 https://bugzilla.suse.com/969779 SUSE Bug 969779