CVE-2008-4309
Fixed in a distro release EPSS 5%CVSS 7.5
Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.
Products: net-snmp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | net-snmp | 5.4.1~dfsg-11 |
| Debian 13 | net-snmp | 5.4.1~dfsg-11 |
| Debian 14 | net-snmp | 5.4.1~dfsg-11 |
| Debian 4.0 | net-snmp | 5.2.3-7etch4 |
| Red Hat Enterprise Linux 3 | net-snmp | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 3 | net-snmp-debuginfo | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 3 | net-snmp-devel | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 3 | net-snmp-libs | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 3 | net-snmp-perl | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 3 | net-snmp-utils | 0:5.0.9-2.30E.25 |
| Red Hat Enterprise Linux 4 | net-snmp | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 4 | net-snmp-debuginfo | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 4 | net-snmp-devel | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 4 | net-snmp-libs | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 4 | net-snmp-perl | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 4 | net-snmp-utils | 0:5.1.2-13.el4_7.2 |
| Red Hat Enterprise Linux 5 | net-snmp | 1:5.3.1-24.el5_2.2 |
| Red Hat Enterprise Linux 5 | net-snmp-debuginfo | 1:5.3.1-24.el5_2.2 |
| Red Hat Enterprise Linux 5 | net-snmp-devel | 1:5.3.1-24.el5_2.2 |
| Red Hat Enterprise Linux 5 | net-snmp-libs | 1:5.3.1-24.el5_2.2 |
| Red Hat Enterprise Linux 5 | net-snmp-perl | 1:5.3.1-24.el5_2.2 |
| Red Hat Enterprise Linux 5 | net-snmp-utils | 1:5.3.1-24.el5_2.2 |
| openSUSE Tumbleweed | net-snmp | 5.9-3.2 |