Executive Summary

Summary
Title Sun Alert 239785 Security Vulnerability in the System Management Agent (SMA) SNMP daemon (snmpd(1M))
Informations
Name SUN-239785 First vendor Publication 2008-07-17
Vendor Sun Last vendor Modification 2008-07-17
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Solaris 10 Operating System OpenSolaris
State: Workaround
First released: 17-Jul-2008
Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-66-239785-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_239785_security_vulnerability

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11261
 
Oval ID: oval:org.mitre.oval:def:11261
Title: Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
Description: Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
Family: unix Class: vulnerability
Reference(s): CVE-2008-2292
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

ExploitDB Exploits

id Description
2008-11-12 Net-SNMP <= 5.1.4/5.2.4/5.4.1 Perl Module Buffer Overflow PoC

OpenVAS Exploits

Date Description
2009-10-13 Name : SLES10: Security update for net-snmp
File : nvt/sles10_net-snmp1.nasl
2009-10-13 Name : Solaris Update for SMA 120273-27
File : nvt/gb_solaris_120273_27.nasl
2009-10-13 Name : Solaris Update for SMA 120272-25
File : nvt/gb_solaris_120272_25.nasl
2009-10-10 Name : SLES9: Security update for net-snmp
File : nvt/sles9p5031860.nasl
2009-09-23 Name : Solaris Update for SMA 120273-26
File : nvt/gb_solaris_120273_26.nasl
2009-09-23 Name : Solaris Update for SMA 120272-24
File : nvt/gb_solaris_120272_24.nasl
2009-06-03 Name : Solaris Update for SMA 120273-25
File : nvt/gb_solaris_120273_25.nasl
2009-06-03 Name : Solaris Update for SMA 120272-23
File : nvt/gb_solaris_120272_23.nasl
2009-04-09 Name : Mandriva Update for net-snmp MDVSA-2008:118 (net-snmp)
File : nvt/gb_mandriva_MDVSA_2008_118.nasl
2009-03-23 Name : Ubuntu Update for net-snmp vulnerabilities USN-685-1
File : nvt/gb_ubuntu_USN_685_1.nasl
2009-03-06 Name : RedHat Update for net-snmp RHSA-2008:0529-01
File : nvt/gb_RHSA-2008_0529-01_net-snmp.nasl
2009-02-27 Name : CentOS Update for net-snmp CESA-2008:0529 centos4 x86_64
File : nvt/gb_CESA-2008_0529_net-snmp_centos4_x86_64.nasl
2009-02-27 Name : CentOS Update for net-snmp CESA-2008:0529 centos4 i386
File : nvt/gb_CESA-2008_0529_net-snmp_centos4_i386.nasl
2009-02-27 Name : CentOS Update for net-snmp CESA-2008:0529 centos3 x86_64
File : nvt/gb_CESA-2008_0529_net-snmp_centos3_x86_64.nasl
2009-02-27 Name : CentOS Update for net-snmp CESA-2008:0529 centos3 i386
File : nvt/gb_CESA-2008_0529_net-snmp_centos3_i386.nasl
2009-02-17 Name : Fedora Update for net-snmp FEDORA-2008-5224
File : nvt/gb_fedora_2008_5224_net-snmp_fc7.nasl
2009-02-17 Name : Fedora Update for net-snmp FEDORA-2008-9362
File : nvt/gb_fedora_2008_9362_net-snmp_fc8.nasl
2009-02-17 Name : Fedora Update for net-snmp FEDORA-2008-9367
File : nvt/gb_fedora_2008_9367_net-snmp_fc9.nasl
2009-02-17 Name : Fedora Update for net-snmp FEDORA-2008-5218
File : nvt/gb_fedora_2008_5218_net-snmp_fc8.nasl
2009-02-17 Name : Fedora Update for net-snmp FEDORA-2008-5215
File : nvt/gb_fedora_2008_5215_net-snmp_fc9.nasl
2009-01-23 Name : SuSE Update for net-snmp SUSE-SA:2008:039
File : nvt/gb_suse_2008_039.nasl
2008-11-19 Name : Debian Security Advisory DSA 1663-1 (net-snmp)
File : nvt/deb_1663_1.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200808-02 (net-snmp)
File : nvt/glsa_200808_02.nasl
0000-00-00 Name : Slackware Advisory SSA:2008-210-07 net-snmp
File : nvt/esoft_slk_ssa_2008_210_07.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
45136 Net-SNMP Perl Module perl/SNMP/SNMP.xs __snprint_value() Function Overflow

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0529.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080610_net_snmp_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12204.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESX host is missing one or more security-related patches.
File : vmware_VMSA-2008-0013.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libsnmp15-080706.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-685-1.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-118.nasl - Type : ACT_GATHER_INFO
2008-11-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1663.nasl - Type : ACT_GATHER_INFO
2008-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2008-9362.nasl - Type : ACT_GATHER_INFO
2008-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2008-9367.nasl - Type : ACT_GATHER_INFO
2008-08-07 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200808-02.nasl - Type : ACT_GATHER_INFO
2008-08-01 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_net-snmp-5422.nasl - Type : ACT_GATHER_INFO
2008-08-01 Name : The remote openSUSE host is missing a security update.
File : suse_libsnmp15-5418.nasl - Type : ACT_GATHER_INFO
2008-07-29 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-210-07.nasl - Type : ACT_GATHER_INFO
2008-06-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0529.nasl - Type : ACT_GATHER_INFO
2008-06-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0529.nasl - Type : ACT_GATHER_INFO
2008-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2008-5215.nasl - Type : ACT_GATHER_INFO
2008-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2008-5224.nasl - Type : ACT_GATHER_INFO
2008-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2008-5218.nasl - Type : ACT_GATHER_INFO
2007-06-04 Name : The remote host is missing Sun Security Patch number 120273-42
File : solaris10_x86_120273.nasl - Type : ACT_GATHER_INFO
2007-05-20 Name : The remote host is missing Sun Security Patch number 120272-40
File : solaris10_120272.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2013-02-06 19:08:17
  • Multiple Updates