CVE-2008-1673

Description

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

Category

10.0
CVSS
Severity: Critical
CVSS 2.0 •
EPSS 18.36% Top 10%
Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory mandriva.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory secunia.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html vendor advisory
http://secunia.com/advisories/30000 third party advisory
http://secunia.com/advisories/30658 third party advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0189
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html vendor advisory
http://www.securityfocus.com/bid/29589 vdb entry patch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00587.html vendor advisory
http://secunia.com/advisories/32104 third party advisory
http://secunia.com/advisories/30982 third party advisory
http://secunia.com/advisories/30580 third party advisory vendor advisory
http://www.securityfocus.com/archive/1/493300/100/0/threaded mailing list
https://exchange.xforce.ibmcloud.com/vulnerabilities/42921 vdb entry
http://secunia.com/advisories/30644 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html vendor advisory
http://secunia.com/advisories/32103 third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:113 vendor advisory
http://www.securitytracker.com/id?1020210 vdb entry
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174 vendor advisory
http://secunia.com/advisories/32759 third party advisory
http://www.vupen.com/english/advisories/2008/1770 vdb entry
http://secunia.com/advisories/31107 third party advisory
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5
http://secunia.com/advisories/32370 third party advisory
http://secunia.com/advisories/31836 third party advisory
http://www.ubuntu.com/usn/usn-625-1 vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=443962
http://www.debian.org/security/2008/dsa-1592 vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html vendor advisory
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c
http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6

Frequently Asked Questions

What is the severity of CVE-2008-1673?
CVE-2008-1673 has been scored as a critical severity vulnerability.
How to fix CVE-2008-1673?
To fix CVE-2008-1673, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-1673 being actively exploited in the wild?
It is possible that CVE-2008-1673 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~18% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.