CVE-2009-1887: Divide by Zero
agent/snmpagent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.
Other sources
It was discovered that remote attacker can cause net-snmp's snmpd to crash via specially crafted SNMP GetBulk requests, that triggers division by zero in the following code:
if (maxbulk <= 0 || maxbulk > maxresponses / r) maxbulk = maxresponses / r;
This code has been added as part of the fix for CVE-2008-4309 (bug #469349). This problem never affected upstream net-snmp versions, thanks to following upstream commit from 2004:
http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/agent/snmpagent.c?r1=9583&r2=9695
This upstream change is part of net-snmp packages shipped in Red Hat Enterprise Linux 4 and later. Therefore this division by zero DoS only affects net-snmp in Red Hat Enterprise Linux 3.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1887?
CVE-2009-1887 has been classified as a high-severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2009-1887?
To fix CVE-2009-1887, update the net-snmp package to a version that has patched this vulnerability.
What software is affected by CVE-2009-1887?
CVE-2009-1887 affects net-snmp version 5.0.9 on Red Hat Enterprise Linux 3.
What type of attack does CVE-2009-1887 exploit?
CVE-2009-1887 can be exploited via a crafted SNMP GETBULK request that leads to a daemon crash.
Is there an available workaround for CVE-2009-1887?
There is no official workaround for CVE-2009-1887; patching the software is the recommended solution.