CVE-2008-1673

Linux kernel <2.4.36.6 & 2.6 <2.6.25.5 - DoS/Code Injection

Title source: llm
STIX 2.1

Description

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

References (34)

Core 34
Core References
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29589
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30000
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30658
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0189
Vendor Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00587.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32104
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30982
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30580
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/493300/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42921
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30644
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32103
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:113
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020210
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32759
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1770
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31107
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32370
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31836
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-625-1
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=443962
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1592

Scores

EPSS 0.0709
EPSS Percentile 93.5%

Details

CWE
CWE-119
Status published
Products (20)
debian/debian_linux 4.0 (13 CPE variants)
linux/linux_kernel 2.4.0 (13 CPE variants)
linux/linux_kernel 2.4.1
linux/linux_kernel 2.4.2
linux/linux_kernel 2.4.3
linux/linux_kernel 2.4.4
linux/linux_kernel 2.4.5
linux/linux_kernel 2.4.6
linux/linux_kernel 2.4.7
linux/linux_kernel 2.4.8
... and 10 more
Published Jun 10, 2008
Tracked Since Feb 18, 2026