Upstream information

CVE-2008-1673 at MITRE

Description

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

SUSE information

Overall state of this security issue: Ignore

This issue is currently rated as having critical severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 10
Vector AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entries: 397347 [VERIFIED / FIXED], 415690 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 11 SP1
SUSE Linux Enterprise Server 11 SP2
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Software Development Kit 11 SP4
SUSE Linux Enterprise Realtime 10 SP2
  • kernel-rt >= 2.6.22.19-0.15
  • kernel-rt_debug >= 2.6.22.19-0.15
  • kernel-rt_timing >= 2.6.22.19-0.15
  • kernel-source >= 2.6.22.19-0.15
  • kernel-syms >= 2.6.22.19-0.15
sles10-sp2.x86-64
ZYPP Patch Nr: 5398
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.27
  • kernel-kdump >= 2.6.16.60-0.27
  • kernel-xen >= 2.6.16.60-0.27
  • kernel-xenpae >= 2.6.16.60-0.27
sle10-sp2-sdk.x86
sles10-sp2-debuginfo.x86
sles10-sp2.x86
sled10-sp2.x86
ZYPP Patch Nr: 5473
SUSE Linux Enterprise SDK 10 SP2
  • kernel-kdump >= 2.6.16.60-0.25
sle10-sp2-sdk.ppc
sles10-sp2.ppc
sles10-sp2-debuginfo.ppc
ZYPP Patch Nr: 5425
SUSE Linux Enterprise SDK 10 SP2
  • kernel-kdump >= 2.6.16.60-0.29
sle10-sp2-sdk.ppc
sles10-sp2-debuginfo.ppc
sles10-sp2.ppc
ZYPP Patch Nr: 5562
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.29
sles10-sp2.ia64
sles10-sp2-debuginfo.ia64
sle10-sp2-sdk.ia64
ZYPP Patch Nr: 5561
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.29
  • kernel-kdump >= 2.6.16.60-0.29
  • kernel-xen >= 2.6.16.60-0.29
  • kernel-xenpae >= 2.6.16.60-0.29
sled10-sp2.x86
sle10-sp2-sdk.x86
sles10-sp2-debuginfo.x86
sles10-sp2.x86
ZYPP Patch Nr: 5565
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.25
ZYPP Patch Nr: 5424
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.30
  • kernel-kdump >= 2.6.16.60-0.30
  • kernel-xen >= 2.6.16.60-0.30
sles10-sp2-debuginfo.x86-64
sled10-sp2.x86-64
sle10-sp2-sdk.x86-64
sles10-sp2.x86-64
ZYPP Patch Nr: 5605
Novell Linux Desktop 9 for x86
  • kernel-bigsmp >= 2.6.5-7.314
  • kernel-default >= 2.6.5-7.314
  • kernel-smp >= 2.6.5-7.314
  • kernel-source >= 2.6.5-7.314
  • kernel-syms >= 2.6.5-7.314
sles9-oes.x86
sles9-nld.x86
YOU Patch Nr: 12247
Open Enterprise Server
  • kernel-bigsmp >= 2.6.5-7.314
  • kernel-debug >= 2.6.5-7.314
  • kernel-default >= 2.6.5-7.314
  • kernel-smp >= 2.6.5-7.314
  • kernel-source >= 2.6.5-7.314
  • kernel-syms >= 2.6.5-7.314
  • kernel-um >= 2.6.5-7.314
  • kernel-xen >= 2.6.5-7.314
  • kernel-xenpae >= 2.6.5-7.314
  • um-host-install-initrd >= 1.0-48.28
  • um-host-kernel >= 2.6.5-7.314
sles9-oes.x86
sles9-nld.x86
YOU Patch Nr: 12247
SUSE Linux Enterprise Realtime 10 SP2
  • kernel-rt >= 2.6.22.19-0.15
  • kernel-rt_bigsmp >= 2.6.22.19-0.15
  • kernel-rt_debug >= 2.6.22.19-0.15
  • kernel-rt_timing >= 2.6.22.19-0.15
  • kernel-source >= 2.6.22.19-0.15
  • kernel-syms >= 2.6.22.19-0.15
sles10-sp2.x86
ZYPP Patch Nr: 5397
SUSE Linux Enterprise Realtime 10 SP2
  • kernel-rt >= 2.6.22.19-0.18
  • kernel-rt_bigsmp >= 2.6.22.19-0.18
  • kernel-rt_debug >= 2.6.22.19-0.18
  • kernel-rt_timing >= 2.6.22.19-0.18
  • kernel-source >= 2.6.22.19-0.18
  • kernel-syms >= 2.6.22.19-0.18
sles10-sp2.x86
sles10-sp2.x86-64
ZYPP Patch Nr: 5710
SUSE Linux Enterprise Realtime 10 SP2
  • kernel-rt >= 2.6.22.19-0.18
  • kernel-rt_debug >= 2.6.22.19-0.18
  • kernel-rt_timing >= 2.6.22.19-0.18
  • kernel-source >= 2.6.22.19-0.18
  • kernel-syms >= 2.6.22.19-0.18
sles10-sp2.x86
sles10-sp2.x86-64
ZYPP Patch Nr: 5710
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.27
  • kernel-kdump >= 2.6.16.60-0.27
  • kernel-xen >= 2.6.16.60-0.27
sles10-sp2.x86-64
sled10-sp2.x86-64
sle10-sp2-sdk.x86-64
sles10-sp2-debuginfo.x86-64
ZYPP Patch Nr: 5477
Novell Linux Desktop 9 for x86_64
  • kernel-default >= 2.6.5-7.314
  • kernel-smp >= 2.6.5-7.314
  • kernel-source >= 2.6.5-7.314
  • kernel-syms >= 2.6.5-7.314
sles9-nld.x86-64
YOU Patch Nr: 12252
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.27
sles10-sp2-debuginfo.ia64
sle10-sp2-sdk.ia64
sles10-sp2.ia64
ZYPP Patch Nr: 5474
openSUSE 11.0
  • kernel-debug-debuginfo >= 2.6.25.16-0.1
  • kernel-debug-debugsource >= 2.6.25.16-0.1
  • kernel-default-debuginfo >= 2.6.25.16-0.1
  • kernel-default-debugsource >= 2.6.25.16-0.1
  • kernel-kdump-debuginfo >= 2.6.25.16-0.1
  • kernel-kdump-debugsource >= 2.6.25.16-0.1
  • kernel-pae-debuginfo >= 2.6.25.16-0.1
  • kernel-pae-debugsource >= 2.6.25.16-0.1
  • kernel-ppc64-debuginfo >= 2.6.25.16-0.1
  • kernel-ppc64-debugsource >= 2.6.25.16-0.1
  • kernel-ps3-debuginfo >= 2.6.25.16-0.1
  • kernel-ps3-debugsource >= 2.6.25.16-0.1
  • kernel-rt-debuginfo >= 2.6.25.16-0.1
  • kernel-rt-debugsource >= 2.6.25.16-0.1
  • kernel-rt_debug-debuginfo >= 2.6.25.16-0.1
  • kernel-rt_debug-debugsource >= 2.6.25.16-0.1
  • kernel-source-debuginfo >= 2.6.25.16-0.1
  • kernel-vanilla-debuginfo >= 2.6.25.16-0.1
  • kernel-vanilla-debugsource >= 2.6.25.16-0.1
  • kernel-xen-debuginfo >= 2.6.25.16-0.1
  • kernel-xen-debugsource >= 2.6.25.16-0.1
openSUSE 11.0
  • kernel-debug >= 2.6.25.16-0.1
  • kernel-default >= 2.6.25.16-0.1
  • kernel-docs >= 2.6.25.16-0.1
  • kernel-kdump >= 2.6.25.16-0.1
  • kernel-pae >= 2.6.25.16-0.1
  • kernel-ppc64 >= 2.6.25.16-0.1
  • kernel-rt >= 2.6.25.16-0.1
  • kernel-rt_debug >= 2.6.25.16-0.1
  • kernel-source >= 2.6.25.16-0.1
  • kernel-syms >= 2.6.25.16-0.1
  • kernel-vanilla >= 2.6.25.16-0.1
  • kernel-xen >= 2.6.25.16-0.1
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.25
  • kernel-kdump >= 2.6.16.60-0.25
  • kernel-xen >= 2.6.16.60-0.25
  • kernel-xenpae >= 2.6.16.60-0.25
ZYPP Patch Nr: 5423
SUSE Linux Enterprise SDK 10 SP2
  • kernel-debug >= 2.6.16.60-0.25
  • kernel-kdump >= 2.6.16.60-0.25
  • kernel-xen >= 2.6.16.60-0.25
ZYPP Patch Nr: 5426
SUSE Linux Enterprise SDK 10 SP2
  • kernel-kdump >= 2.6.16.60-0.27
sle10-sp2-sdk.ppc
sles10-sp2-debuginfo.ppc
sles10-sp2.ppc
ZYPP Patch Nr: 5475