REDHAT-BUG-506903: Integer Overflow
First published: Fri Jun 19 2009(Updated: )
It was discovered that remote attacker can cause net-snmp's snmpd to crash via specially crafted SNMP GetBulk requests, that triggers division by zero in the following code: if (maxbulk <= 0 || maxbulk > maxresponses / r) maxbulk = maxresponses / r; This code has been added as part of the fix for <a href="https://access.redhat.com/security/cve/CVE-2008-4309">CVE-2008-4309</a> (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2008-4309 net-snmp: numresponses calculation integer overflow in snmp_agent.c" href="show_bug.cgi?id=469349">bug #469349</a>). This problem never affected upstream net-snmp versions, thanks to following upstream commit from 2004: <a href="http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/agent/snmp_agent.c?r1=9583&r2=9695">http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/agent/snmp_agent.c?r1=9583&r2=9695</a> This upstream change is part of net-snmp packages shipped in Red Hat Enterprise Linux 4 and later. Therefore this division by zero DoS only affects net-snmp in Red Hat Enterprise Linux 3.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Net-SNMP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2008-4309
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=469349
- http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/trunk/net-snmp/agent/snmp_agent.c?r1=9583&r2=9695
- https://rhn.redhat.com/errata/RHSA-2009-1124.html
- https://bugzilla.redhat.com/show_bug.cgi?id=506903
Frequently Asked Questions
What is the severity of REDHAT-BUG-506903?
The severity of REDHAT-BUG-506903 is considered to be high due to the potential for remote attackers to crash the net-snmp service.
How do I fix REDHAT-BUG-506903?
To fix REDHAT-BUG-506903, update to the latest version of net-snmp that addresses this vulnerability.
Who is affected by REDHAT-BUG-506903?
Users of Red Hat net-snmp versions that are vulnerable to specially crafted SNMP GetBulk requests are affected by REDHAT-BUG-506903.
What type of attack is related to REDHAT-BUG-506903?
REDHAT-BUG-506903 is related to a denial-of-service attack that can crash the net-snmp daemon through crafted SNMP requests.
Is there a known exploit for REDHAT-BUG-506903?
Yes, there are known exploitation methods that can trigger the division by zero error in net-snmp's snmpd.
- collector/redhat-bugzilla
- alias/CVE-2009-1887
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/net-snmp