SNMP4J libraries are currently () reported as:

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

CVSS:7.5
URL:CVE-2015-5621
CWE:CWE-19 Data Handling

It seems that the OWASP dependency check simply looks for the keyword "SNMP" in JAR and package names (which is part of SNMP4J). That is of course too simple and really bad quality. A bug report has been created at OWASP dependency check:  

https://github.com/jeremylong/DependencyCheck/issues/1248


False Positive!

SNMP4J and any related APIs (i.e. SNMP4J-Agent, SNMP4J-AgentX, SNMP4J-SMI-PRO, SNMP4J-Model, ...) have no dependencies to NET-SNMP and they do not have any code in common.

  • No labels