SB2018090404 - Red Hat update for collectd
Published: September 4, 2018
Security Bulletin ID
SB2018090404
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2017-7401)
CWE-ID: CWE-399 - Resource Management Errors
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to cause denial of service (DoS) conditions.
The vulnerability exists due to improper input validation when processing UDP requests within the parse_packet() and parse_part_sign_sha256() functions in network.c.A remote attacker can send specially crafted UDP packets to vulnerable instance of collectd and trigger infinite loop.
Successful exploitation of the vulnerability may allow an attacker to cause denial of service (DoS) conditions, but requires that collectd is configured with "SecurityLevel None" and with empty "AuthFile" options.
2) Denial of service (CVE-ID: CVE-2017-16820)
CWE-ID: CWE-415 - Double Free
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.
The weakness exists due to the csnmp_read_table function in the snmp.c code in the SNMP plug-in of the collectd daemon. A remote attacker can send specially crafted input to the target system, trigger a double-free memory condition and cause the collected daemon to crash.
Remediation
Install update from vendor's website.