REDHAT-BUG-469349: Buffer Overflow

First published: Fri Oct 31 2008(Updated: )

Oscar Mira-Sanchez reported (via TippingPoint/ZDI) to Net-SNMP upstream an integer overflow in the numresponses calculation in snmp_agent.c. Size of memory requirement for bulkcache array is calculated based on the values form an SNMP request without properly checking for integer overflows, resulting in an insufficient memory allocation and heap-based buffer overflow. agent/snmp_agent.c: numresponses = asp->pdu->errindex * r; [ ... ] asp->bulkcache = (netsnmp_variable_list **) malloc(numresponses * sizeof(struct varbind_list *)); Issue can be triggered by an SNMP get request.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2008-4309
• agent/weakness
• agent/type
• agent/last-modified-date
• agent/first-publish-date
• agent/severity
• agent/description
• agent/softwarecombine
• agent/tags
• agent/references
• agent/event
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/net-snmp
• canonical/net-snmp