CVE - CVE-2008-1673

CVE-ID
CVE-2008-1673	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1020210 URL:http://www.securitytracker.com/id?1020210 MISC:20080611 rPSA-2008-0189-1 kernel xen URL:http://www.securityfocus.com/archive/1/493300/100/0/threaded MISC:29589 URL:http://www.securityfocus.com/bid/29589 MISC:30000 URL:http://secunia.com/advisories/30000 MISC:30580 URL:http://secunia.com/advisories/30580 MISC:30644 URL:http://secunia.com/advisories/30644 MISC:30658 URL:http://secunia.com/advisories/30658 MISC:30982 URL:http://secunia.com/advisories/30982 MISC:31107 URL:http://secunia.com/advisories/31107 MISC:31836 URL:http://secunia.com/advisories/31836 MISC:32103 URL:http://secunia.com/advisories/32103 MISC:32104 URL:http://secunia.com/advisories/32104 MISC:32370 URL:http://secunia.com/advisories/32370 MISC:32759 URL:http://secunia.com/advisories/32759 MISC:ADV-2008-1770 URL:~~http://www.vupen.com/english/advisories/2008/1770~~ (Obsolete source) MISC:DSA-1592 URL:http://www.debian.org/security/2008/dsa-1592 MISC:FEDORA-2008-5308 URL:https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00587.html MISC:MDVSA-2008:113 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2008:113~~ (Obsolete source) MISC:MDVSA-2008:174 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2008:174~~ (Obsolete source) MISC:SUSE-SA:2008:035 URL:http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html MISC:SUSE-SA:2008:038 URL:http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html MISC:SUSE-SA:2008:047 URL:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html MISC:SUSE-SA:2008:048 URL:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html MISC:SUSE-SA:2008:049 URL:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html MISC:SUSE-SA:2008:052 URL:http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html MISC:SUSE-SR:2008:025 URL:http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html MISC:USN-625-1 URL:http://www.ubuntu.com/usn/usn-625-1 MISC:http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c URL:http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c MISC:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5 URL:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5 MISC:http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6 URL:http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6 MISC:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5 URL:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5 MISC:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0189 URL:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0189 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=443962 URL:https://bugzilla.redhat.com/show_bug.cgi?id=443962 MISC:linux-kernel-ber-decoder-bo(42921) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/42921
Assigning CNA
Red Hat, Inc.
Date Record Created
20080403	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080403)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)