CVE-2008-4309: Input Validation
Integer overflow in the netsnmpcreatesubtreecache function in agent/snmpagent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.
Other sources
Oscar Mira-Sanchez reported (via TippingPoint/ZDI) to Net-SNMP upstream an integer overflow in the numresponses calculation in snmpagent.c. Size of memory requirement for bulkcache array is calculated based on the values form an SNMP request without properly checking for integer overflows, resulting in an insufficient memory allocation and heap-based buffer overflow.
agent/snmpagent.c:
numresponses = asp->pdu->errindex r;
[ ... ]
asp->bulkcache = (netsnmpvariablelist ) malloc(numresponses sizeof(struct varbindlist ));
Issue can be triggered by an SNMP get request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4309?
CVE-2008-4309 is a high severity vulnerability that can lead to denial of service through a crafted SNMP GETBULK request.
How do I fix CVE-2008-4309?
To fix CVE-2008-4309, upgrade to net-snmp version 5.4.2.1 or later for affected systems.
Which versions of net-snmp are vulnerable to CVE-2008-4309?
Versions of net-snmp before 5.4.2.1, 5.3.2.3, and 5.2.5.1 are vulnerable to CVE-2008-4309.
What kind of attack is possible with CVE-2008-4309?
CVE-2008-4309 allows remote attackers to conduct a denial of service attack by triggering a heap-based buffer overflow.
Is there a specific software source affected by CVE-2008-4309?
Yes, the vulnerability affects the net-snmp package provided by Red Hat for specific versions.