SUSE-SU-2015:1556-1: moderate: Security update for net-snmp

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for net-snmp
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:1556-1
Rating:             moderate
References:         #909479 #935863 #935876 #940084 #940188 
Cross-References:   CVE-2015-5621
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12
                    SUSE Linux Enterprise Server 12
                    SUSE Linux Enterprise Desktop 12
______________________________________________________________________________

   An update that solves one vulnerability and has four fixes
   is now available.

Description:


   The following issues have been fixed within this update:

   * fix btrfs output inside HOST-RESOURCES-MIB::hrStorageDescr. (bsc#909479)
   * fix an incompletely initialized vulnerability within the
     snmp_pdu_parse() function of snmp_api.c. (bsc#940188, CVE-2015-5621)
   * add build requirement 'procps' to fix a net-snmp-config error
     (bsc#935863)
   * --disable-md5 to allow operation in FIPS mode and not use the
     old algorithm (bsc#935876 bsc#940084)
   * also stop snmptrapd on removal


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12:

      zypper in -t patch SUSE-SLE-SDK-12-2015-537=1

   - SUSE Linux Enterprise Server 12:

      zypper in -t patch SUSE-SLE-SERVER-12-2015-537=1

   - SUSE Linux Enterprise Desktop 12:

      zypper in -t patch SUSE-SLE-DESKTOP-12-2015-537=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64):

      net-snmp-debuginfo-5.7.2.1-4.3.2
      net-snmp-debugsource-5.7.2.1-4.3.2
      net-snmp-devel-5.7.2.1-4.3.2

   - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):

      libsnmp30-5.7.2.1-4.3.2
      libsnmp30-debuginfo-5.7.2.1-4.3.2
      net-snmp-5.7.2.1-4.3.2
      net-snmp-debuginfo-5.7.2.1-4.3.2
      net-snmp-debugsource-5.7.2.1-4.3.2
      perl-SNMP-5.7.2.1-4.3.2
      perl-SNMP-debuginfo-5.7.2.1-4.3.2
      snmp-mibs-5.7.2.1-4.3.2

   - SUSE Linux Enterprise Server 12 (s390x x86_64):

      libsnmp30-32bit-5.7.2.1-4.3.2
      libsnmp30-debuginfo-32bit-5.7.2.1-4.3.2

   - SUSE Linux Enterprise Desktop 12 (x86_64):

      libsnmp30-32bit-5.7.2.1-4.3.2
      libsnmp30-5.7.2.1-4.3.2
      libsnmp30-debuginfo-32bit-5.7.2.1-4.3.2
      libsnmp30-debuginfo-5.7.2.1-4.3.2
      net-snmp-5.7.2.1-4.3.2
      net-snmp-debuginfo-5.7.2.1-4.3.2
      net-snmp-debugsource-5.7.2.1-4.3.2
      perl-SNMP-5.7.2.1-4.3.2
      perl-SNMP-debuginfo-5.7.2.1-4.3.2
      snmp-mibs-5.7.2.1-4.3.2


References:

   https://www.suse.com/security/cve/CVE-2015-5621.html
   https://bugzilla.suse.com/909479
   https://bugzilla.suse.com/935863
   https://bugzilla.suse.com/935876
   https://bugzilla.suse.com/940084
   https://bugzilla.suse.com/940188