Description
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
Published: 2008-06-10
Score: 10.0 Critical
EPSS: 18.4% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-1592-1 New Linux 2.6.18 packages fix overflow conditions
Debian DSA Debian DSA DSA-1592-2 New Linux 2.6.18 packages fix overflow conditions
Ubuntu USN Ubuntu USN USN-625-1 Linux kernel vulnerabilities
References
Link Providers
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c cve-icon cve-icon
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5 cve-icon cve-icon
http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6 cve-icon cve-icon
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5 cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html cve-icon cve-icon
http://secunia.com/advisories/30000 cve-icon cve-icon
http://secunia.com/advisories/30580 cve-icon cve-icon
http://secunia.com/advisories/30644 cve-icon cve-icon
http://secunia.com/advisories/30658 cve-icon cve-icon
http://secunia.com/advisories/30982 cve-icon cve-icon
http://secunia.com/advisories/31107 cve-icon cve-icon
http://secunia.com/advisories/31836 cve-icon cve-icon
http://secunia.com/advisories/32103 cve-icon cve-icon
http://secunia.com/advisories/32104 cve-icon cve-icon
http://secunia.com/advisories/32370 cve-icon cve-icon
http://secunia.com/advisories/32759 cve-icon cve-icon
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0189 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1592 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2008:113 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174 cve-icon cve-icon
http://www.securityfocus.com/archive/1/493300/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/29589 cve-icon cve-icon
http://www.securitytracker.com/id?1020210 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-625-1 cve-icon cve-icon
http://www.vupen.com/english/advisories/2008/1770 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=443962 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/42921 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2008-1673 cve-icon
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00587.html cve-icon cve-icon
History

Wed, 28 May 2025 14:45:00 +0000

Type Values Removed Values Added
References

Thu, 22 May 2025 04:30:00 +0000


Subscriptions

Debian Debian Linux
Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T08:32:01.473Z

Reserved: 2008-04-03T00:00:00.000Z

Link: CVE-2008-1673

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2008-06-10T00:32:00.000

Modified: 2026-04-23T00:35:47.467

Link: CVE-2008-1673

cve-icon Redhat

Severity : Low

Publid Date: 2008-06-06T00:00:00Z

Links: CVE-2008-1673 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses