Description
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-1592-1 | New Linux 2.6.18 packages fix overflow conditions |
Debian DSA |
DSA-1592-2 | New Linux 2.6.18 packages fix overflow conditions |
Ubuntu USN |
USN-625-1 | Linux kernel vulnerabilities |
References
History
Wed, 28 May 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
Thu, 22 May 2025 04:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T08:32:01.473Z
Reserved: 2008-04-03T00:00:00.000Z
Link: CVE-2008-1673
No data.
Status : Modified
Published: 2008-06-10T00:32:00.000
Modified: 2026-04-23T00:35:47.467
Link: CVE-2008-1673
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
Ubuntu USN