PT-2017-3220 · Collectd+2 · Collectd+2

Cullorblind · Published 2017-05-19 · Updated 2021-03-15 · CVE-2017-16820

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions collectd versions prior to 5.6.3

Description The issue is related to the csnmp read table function in the SNMP plugin, which is susceptible to a double free error in certain cases. This could lead to a crash or potentially have other impacts. The vulnerability can be exploited by a remote attacker to cause the application to crash or have other effects.

Recommendations For versions prior to 5.6.3, update to version 5.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the SNMP plugin to minimize the risk of exploitation.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2017-1996

BDU:2017-02653

CVE-2017-16820

RHSA-2018:0252

RHSA-2018:0299

RHSA-2018:0560

RHSA-2018:1605

RHSA-2018:2615

USN-4793-1

Affected Products

Alt Linux

Ubuntu

Collectd

References · 24

• https://github.com/collectd/collectd/commit/d16c24542b2f96a194d43a73c2e5778822b9cb47 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16820 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4793-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4793-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0252 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-16820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6254 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2615 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16820 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0299 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16820 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16820 · Security Note
• https://ubuntu.com/security/CVE-2017-7401 · Vendor Advisory