Vulnerabilities > CVE-2017-7401 - Infinite Loop vulnerability in Collectd

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

collectd

CWE-835

nessus

NVD

Published: 2017-04-03

Updated: 2024-11-21

Summary

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.

Vulnerable Configurations

Part	Description	Count
Application	Collectd Collectd Collectd 1.0.0 Collectd Collectd 1.1.0 Collectd Collectd 1.2.0 Collectd Collectd 1.3.0 Collectd Collectd 1.4.0 Collectd Collectd 1.5.0 Collectd Collectd 1.6.0 Collectd Collectd 1.7.0 Collectd Collectd 1.8.0 Collectd Collectd 1.8.1 Collectd Collectd 2.0.0 Collectd Collectd 2.1.0 Collectd Collectd 3.0.0 Collectd Collectd 3.1.0 Collectd Collectd 3.2.0 Collectd Collectd 3.3.0 Collectd Collectd 3.4.0 Collectd Collectd 3.5.0 Collectd Collectd 3.5.1 Collectd Collectd 3.5.2 Collectd Collectd 3.6.0 Collectd Collectd 3.6.1 Collectd Collectd 3.6.2 Collectd Collectd 3.7.0 Collectd Collectd 3.7.1 Collectd Collectd 3.7.2 Collectd Collectd 3.8.0 Collectd Collectd 3.8.1 Collectd Collectd 3.8.2 Collectd Collectd 3.8.3 Collectd Collectd 3.8.4 Collectd Collectd 3.8.5 Collectd Collectd 3.8.6 Collectd Collectd 3.9.0 Collectd Collectd 3.9.1 Collectd Collectd 3.9.2 Collectd Collectd 3.9.3 Collectd Collectd 3.9.4 Collectd Collectd 4.0.0 Collectd Collectd 4.0.1 Collectd Collectd 4.0.2 Collectd Collectd 4.0.3 Collectd Collectd 4.0.4 Collectd Collectd 4.0.5 Collectd Collectd 4.0.6 Collectd Collectd 4.0.7 Collectd Collectd 4.0.8 Collectd Collectd 4.0.9 Collectd Collectd 4.1.0 Collectd Collectd 4.1.1 Collectd Collectd 4.1.2 Collectd Collectd 4.1.3 Collectd Collectd 4.1.4 Collectd Collectd 4.1.5 Collectd Collectd 4.1.6 Collectd Collectd 4.2.0 Collectd Collectd 4.2.1 Collectd Collectd 4.2.2 Collectd Collectd 4.2.3 Collectd Collectd 4.2.4 Collectd Collectd 4.2.5 Collectd Collectd 4.2.6 Collectd Collectd 4.2.7 Collectd Collectd 4.3.0 Collectd Collectd 4.3.1 Collectd Collectd 4.3.2 Collectd Collectd 4.3.3 Collectd Collectd 4.3.4 Collectd Collectd 4.4.0 Collectd Collectd 4.4.1 Collectd Collectd 4.4.2 Collectd Collectd 4.4.3 Collectd Collectd 4.4.4 Collectd Collectd 4.4.5 Collectd Collectd 4.5.0 Collectd Collectd 4.5.1 Collectd Collectd 4.5.2 Collectd Collectd 4.5.3 Collectd Collectd 4.5.4 Collectd Collectd 4.6.0 Collectd Collectd 4.6.1 Collectd Collectd 4.6.2 Collectd Collectd 4.6.3 Collectd Collectd 4.6.4 Collectd Collectd 4.6.5 Collectd Collectd 4.7.0 Collectd Collectd 4.7.1 Collectd Collectd 4.7.2 Collectd Collectd 4.7.3 Collectd Collectd 4.7.4 Collectd Collectd 4.7.5 Collectd Collectd 4.8.0 Collectd Collectd 4.8.1 Collectd Collectd 4.8.2 Collectd Collectd 4.8.3 Collectd Collectd 4.8.4 Collectd Collectd 4.8.5 Collectd Collectd 4.9.0 Collectd Collectd 4.9.1 Collectd Collectd 4.9.2 Collectd Collectd 4.9.3 Collectd Collectd 4.9.4 Collectd Collectd 4.9.5 Collectd Collectd 5.0.0 Collectd Collectd 5.0.1 Collectd Collectd 5.0.2 Collectd Collectd 5.0.3 Collectd Collectd 5.0.4 Collectd Collectd 5.0.5 Collectd Collectd 5.1.0 Collectd Collectd 5.1.1 Collectd Collectd 5.1.2 Collectd Collectd 5.1.3 Collectd Collectd 5.2.0 Collectd Collectd 5.2.1 Collectd Collectd 5.2.2 Collectd Collectd 5.3.0 Collectd Collectd 5.3.1 Collectd Collectd 5.3.2 Collectd Collectd 5.4.0 Collectd Collectd 5.4.1 Collectd Collectd 5.4.2 Collectd Collectd 5.4.3 Collectd Collectd 5.5.0 Collectd Collectd 5.5.1 Collectd Collectd 5.5.2 Collectd Collectd 5.5.3 Collectd Collectd 5.6.0 Collectd Collectd 5.6.1 Collectd Collectd 5.6.2 Collectd Collectd 5.6.3 Collectd Collectd 5.7.0 Collectd Collectd 5.7.1	133

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Nessus

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_08A2DF486C6A11E79B012047478F2F70.NASL
description	marcinguy reports : After sending this payload, collectd seems to be entering endless while() loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.
last seen	2020-06-01
modified	2020-06-02
plugin id	101826
published	2017-07-20
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101826
title	FreeBSD : collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures (08a2df48-6c6a-11e7-9b01-2047478f2f70)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2017-1285.NASL
description	An update for collectd is now available for RHEV 4.X RHEV-H and Agents for RHEL-7 and RHEV Engine version 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files (creating them if necessary). Because the daemon does not start up each time it updates files, it has a low system footprint. The following packages have been upgraded to a newer upstream version: collectd (5.7.1). (BZ#1446472) Security Fix(es) : * collectd contains an infinite loop due to how the parse_packet() and parse_part_sign_sha256() functions interact. If an instance of collectd is configured with
last seen	2020-06-01
modified	2020-06-02
plugin id	100454
published	2017-05-26
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/100454
title	RHEL 7 : collectd (RHSA-2017:1285)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2615.NASL
description	An update for collectd is now available for Red Hat Gluster Storage 3.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. collectd is a host-based system statistics collection daemon that gathers metrics from various sources periodically, such as the operating system, applications, log files and devices, and storage clusters. As the daemon does not start up each time it updates files, it has a low system footprint. For Red Hat Gluster Storage Web Administration 3.4, collectd service is responsible for gathering metrics from Red Hat Gluster Storage clusters. The updated collectd package includes the following security bug fixes. Security Fix(es) : * collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions (CVE-2017-7401) * collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. This updated package contains a number of bug fixes and enhancements, which are documented in detail in the Release Notes, linked in the References. All users of collectd are advised to upgrade to these updated packages, which resolve these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	117321
published	2018-09-06
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117321
title	RHEL 7 : Storage Server (RHSA-2018:2615)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2017-829.NASL
description	Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions : Collectd contains an infinite loop due to how the parse_packet() and parse_part_sign_sha256() functions interact. If an instance of collectd is configured with
last seen	2020-06-01
modified	2020-06-02
plugin id	100274
published	2017-05-19
reporter	This script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/100274
title	Amazon Linux AMI : collectd (ALAS-2017-829)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-6B639AFC9C.NASL
description	Fix CVE-2017-7401 collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions. This is a bug in the network plugin. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2017-04-26
plugin id	99678
published	2017-04-26
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99678
title	Fedora 24 : collectd (2017-6b639afc9c)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-822D460AE2.NASL
description	Fix CVE-2017-7401 collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions. This is a bug in the network plugin. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2017-07-17
plugin id	101671
published	2017-07-17
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/101671
title	Fedora 26 : collectd (2017-822d460ae2)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-80763C8C03.NASL
description	Fix CVE-2017-7401 collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions. This is a bug in the network plugin. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2017-04-25
plugin id	99644
published	2017-04-25
reporter	This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99644
title	Fedora 25 : collectd (2017-80763c8c03)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-884.NASL
description	It was discovered that there was an infinite loop vulnerability in collectd, a statistics collection and monitoring daemon. When a correct
last seen	2020-03-17
modified	2017-04-05
plugin id	99189
published	2017-04-05
reporter	This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/99189
title	Debian DLA-884-1 : collectd security update

Redhat

advisories

rhsa
id RHSA-2017:1285
rhsa
id RHSA-2017:1787
rhsa
id RHSA-2018:2615

rpms

collectd-0:5.7.1-4.el7
collectd-apache-0:5.7.1-4.el7
collectd-ascent-0:5.7.1-4.el7
collectd-bind-0:5.7.1-4.el7
collectd-ceph-0:5.7.1-4.el7
collectd-chrony-0:5.7.1-4.el7
collectd-curl-0:5.7.1-4.el7
collectd-curl_json-0:5.7.1-4.el7
collectd-curl_xml-0:5.7.1-4.el7
collectd-dbi-0:5.7.1-4.el7
collectd-debuginfo-0:5.7.1-4.el7
collectd-disk-0:5.7.1-4.el7
collectd-dns-0:5.7.1-4.el7
collectd-drbd-0:5.7.1-4.el7
collectd-email-0:5.7.1-4.el7
collectd-generic-jmx-0:5.7.1-4.el7
collectd-hugepages-0:5.7.1-4.el7
collectd-ipmi-0:5.7.1-4.el7
collectd-iptables-0:5.7.1-4.el7
collectd-ipvs-0:5.7.1-4.el7
collectd-java-0:5.7.1-4.el7
collectd-log_logstash-0:5.7.1-4.el7
collectd-lvm-0:5.7.1-4.el7
collectd-mysql-0:5.7.1-4.el7
collectd-netlink-0:5.7.1-4.el7
collectd-nginx-0:5.7.1-4.el7
collectd-notify_desktop-0:5.7.1-4.el7
collectd-notify_email-0:5.7.1-4.el7
collectd-openldap-0:5.7.1-4.el7
collectd-ping-0:5.7.1-4.el7
collectd-postgresql-0:5.7.1-4.el7
collectd-rrdcached-0:5.7.1-4.el7
collectd-rrdtool-0:5.7.1-4.el7
collectd-sensors-0:5.7.1-4.el7
collectd-smart-0:5.7.1-4.el7
collectd-snmp-0:5.7.1-4.el7
collectd-turbostat-0:5.7.1-4.el7
collectd-utils-0:5.7.1-4.el7
collectd-virt-0:5.7.1-4.el7
collectd-write_http-0:5.7.1-4.el7
collectd-write_riemann-0:5.7.1-4.el7
collectd-write_sensu-0:5.7.1-4.el7
collectd-write_tsdb-0:5.7.1-4.el7
collectd-zookeeper-0:5.7.1-4.el7
libcollectdclient-0:5.7.1-4.el7
libcollectdclient-devel-0:5.7.1-4.el7
collectd-0:5.7.2-1.1.el7ost
collectd-apache-0:5.7.2-1.1.el7ost
collectd-ascent-0:5.7.2-1.1.el7ost
collectd-bind-0:5.7.2-1.1.el7ost
collectd-ceph-0:5.7.2-1.1.el7ost
collectd-curl-0:5.7.2-1.1.el7ost
collectd-curl_json-0:5.7.2-1.1.el7ost
collectd-curl_xml-0:5.7.2-1.1.el7ost
collectd-dbi-0:5.7.2-1.1.el7ost
collectd-debuginfo-0:5.7.2-1.1.el7ost
collectd-disk-0:5.7.2-1.1.el7ost
collectd-dns-0:5.7.2-1.1.el7ost
collectd-drbd-0:5.7.2-1.1.el7ost
collectd-email-0:5.7.2-1.1.el7ost
collectd-generic-jmx-0:5.7.2-1.1.el7ost
collectd-ipmi-0:5.7.2-1.1.el7ost
collectd-iptables-0:5.7.2-1.1.el7ost
collectd-ipvs-0:5.7.2-1.1.el7ost
collectd-java-0:5.7.2-1.1.el7ost
collectd-log_logstash-0:5.7.2-1.1.el7ost
collectd-lvm-0:5.7.2-1.1.el7ost
collectd-mysql-0:5.7.2-1.1.el7ost
collectd-netlink-0:5.7.2-1.1.el7ost
collectd-nginx-0:5.7.2-1.1.el7ost
collectd-notify_desktop-0:5.7.2-1.1.el7ost
collectd-notify_email-0:5.7.2-1.1.el7ost
collectd-openldap-0:5.7.2-1.1.el7ost
collectd-ping-0:5.7.2-1.1.el7ost
collectd-postgresql-0:5.7.2-1.1.el7ost
collectd-rrdcached-0:5.7.2-1.1.el7ost
collectd-rrdtool-0:5.7.2-1.1.el7ost
collectd-sensors-0:5.7.2-1.1.el7ost
collectd-smart-0:5.7.2-1.1.el7ost
collectd-snmp-0:5.7.2-1.1.el7ost
collectd-turbostat-0:5.7.2-1.1.el7ost
collectd-utils-0:5.7.2-1.1.el7ost
collectd-virt-0:5.7.2-1.1.el7ost
collectd-web-0:5.7.2-1.1.el7ost
collectd-write_http-0:5.7.2-1.1.el7ost
collectd-write_sensu-0:5.7.2-1.1.el7ost
collectd-write_tsdb-0:5.7.2-1.1.el7ost
collectd-zookeeper-0:5.7.2-1.1.el7ost
libcollectdclient-0:5.7.2-1.1.el7ost
perl-Collectd-0:5.7.2-1.1.el7ost
collectd-0:5.7.2-3.1.el7rhgs
collectd-debuginfo-0:5.7.2-3.1.el7rhgs
collectd-ping-0:5.7.2-3.1.el7rhgs
libcollectdclient-0:5.7.2-3.1.el7rhgs

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Redhat

References