Description
Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/33631 ↗
- http://secunia.com/advisories/32664 ↗
- http://secunia.com/advisories/32560 ↗
- http://support.apple.com/kb/HT3549 ↗
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html ↗
- http://www.vmware.com/security/advisories/VMSA-2009-0001.html ↗
- http://www.vupen.com/english/advisories/2009/0301 ↗
- http://secunia.com/advisories/33746 ↗
- http://www.redhat.com/support/errata/RHSA-2008-0971.html ↗
- http://secunia.com/advisories/35074 ↗
- http://secunia.com/advisories/35679 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9860 ↗
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html ↗
- http://secunia.com/advisories/33003 ↗
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-262908-1 ↗
- http://secunia.com/advisories/32539 ↗
- http://secunia.com/advisories/32711 ↗
- http://www.debian.org/security/2008/dsa-1663 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6353 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46262 ↗
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272 ↗
- http://www.openwall.com/lists/oss-security/2008/10/31/1 ↗
- http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html ↗
- http://www.us-cert.gov/cas/techalerts/TA09-133A.html ↗
- http://sourceforge.net/forum/forum.php?forum_id=882903 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6171 ↗
- http://secunia.com/advisories/33095 ↗
- http://www.vupen.com/english/advisories/2009/1297 ↗
- http://www.securitytracker.com/id?1021129 ↗
- http://support.apple.com/kb/HT4298 ↗
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0315 ↗
- http://support.avaya.com/elmodocs2/security/ASA-2008-467.htm ↗
- http://www.vupen.com/english/advisories/2008/2973 ↗
- http://www.securityfocus.com/bid/32020 ↗
- http://secunia.com/advisories/33821 ↗
- http://www.vupen.com/english/advisories/2009/1771 ↗
- http://security.gentoo.org/glsa/glsa-200901-15.xml ↗
- http://www.securityfocus.com/archive/1/498280/100/0/threaded ↗
- http://marc.info/?l=bugtraq&m=125017764422557&w=2 ↗
- http://www.ubuntu.com/usn/usn-685-1 ↗
- http://www.vupen.com/english/advisories/2008/3400 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:225 ↗