CentOS Errata and Security Advisory CESA-2014:0321
The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.
A buffer overflow flaw was found in the way the decode_icmp_msg() function in the ICMP-MIB implementation processed Internet Control Message Protocol (ICMP) message statistics reported in the /proc/net/snmp file. A remote attacker could send a message for each ICMP message type, which could potentially cause the snmpd service to crash when processing the /proc/net/snmp file. (CVE-2014-2284)
This update also fixes the following bug:
All net-snmp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the snmpd service will be restarted automatically.
Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2014-March/020224.html
Affected packages: net-snmp net-snmp-devel net-snmp-libs net-snmp-perl net-snmp-python net-snmp-utils
Upstream details at: https://rhn.redhat.com/errata/RHSA-2014-0321.html