Bug 202099

Summary: net-mgmt/net-snmp: Fix CVE-2015-5621
Product: Ports & Packages Reporter: Sergey N. Voronkov <snvoronkov>
Component: Individual Port(s)Assignee: Ryan Steinmetz <zi>
Status: Closed FIXED    
Severity: Affects Many People CC: erwin, ports-secteam
Priority: --- Keywords: needs-qa, patch, security
Version: LatestFlags: bugzilla: maintainer-feedback? (zi)
Hardware: amd64   
OS: Any   
Attachments:
Description Flags
patch file none

Description Sergey N. Voronkov 2015-08-05 08:51:55 UTC 
Created attachment 159567 [details]
patch file

http://vuxml.freebsd.org/freebsd/381183e8-3798-11e5-9970-14dae9d210b8.html

Incompletely initialized vulnerability exists in the function ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory leak, DOS and possible command executions by sending malicious packets.

Adopt upstream fix.

Patch attached.
Comment 1 commit-hook freebsd_committer freebsd_triage 2015-08-10 02:16:39 UTC 
A commit references this bug:

Author: zi
Date: Mon Aug 10 02:15:53 UTC 2015
New revision: 393838
URL: https://svnweb.freebsd.org/changeset/ports/393838

Log:
  - Fix CVE-2015-5621
  - Bump PORTREVISION

  PR:		202099
  Submitted by:	serg@tmn.ru

Changes:
  head/net-mgmt/net-snmp/Makefile
  head/net-mgmt/net-snmp/files/patch-snmplib_snmp__api.c
Comment 2 commit-hook freebsd_committer freebsd_triage 2015-08-10 13:09:22 UTC 
A commit references this bug:

Author: zi
Date: Mon Aug 10 13:08:24 UTC 2015
New revision: 393862
URL: https://svnweb.freebsd.org/changeset/ports/393862

Log:
  MFH: r393838

  - Fix CVE-2015-5621
  - Bump PORTREVISION

  PR:		202099
  Submitted by:	serg@tmn.ru
  Approved by:	ports-secteam (zi)

Changes:
_U  branches/2015Q3/
  branches/2015Q3/net-mgmt/net-snmp/Makefile
  branches/2015Q3/net-mgmt/net-snmp/files/patch-snmplib_snmp__api.c