K17378 : SNMP vulnerability CVE-2015-5621

Security Advisory Description

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet. (CVE-2015-5621)
Impact
A remote, unauthenticated attacker could use this flaw to interrupt the snmpd process, or potentially run arbitrary code on the system with the privileges of the user running thesnmpd process. In default BIG-IP, BIG-IQ, and Enterprise Manager configurations, the data plane is not exposed to this vulnerability; however, the control plane has remote exposure to this vulnerability because SNMP is, by default, enabled on the management network interface.