CVE-2014-2285

MEDIUM 4.3CVE-2014-2285 · Published 27/04/2014 · updated 17/06/2026

In short

CVE-2014-2285 is a MEDIUM (CVSS 4.3) vulnerability affecting net-snmp (net-snmp).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
net-snmp net-snmp	`≤ 5.7.3`	No fix yet

Description

The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.

References

comments.gmane.org/gmane.comp.security.oss.general/12284
kb.juniper.net/InfoCenter/index
lists.opensuse.org/opensuse-updates/2014-03/msg00060.html
lists.opensuse.org/opensuse-updates/2014-03/msg00061.html
secunia.com/advisories/59974
sourceforge.net/p/net-snmp/patches/1275
gentoo.org/security/en/glsa/glsa-201409-02.xml
nntp.perl.org/group/perl.perl5.porters/2006/09/msg116250.html
bugzilla.redhat.com/show_bug.cgi · Vendor Advisory
bugzilla.redhat.com/show_bug.cgi
rhn.redhat.com/errata/RHSA-2014-0322.html

More vulnerabilities in net-snmp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free