CVE-2008-1673
Publication date 10 June 2008
Last updated 24 July 2024
Ubuntu priority
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
From the Ubuntu Security Team
Wei Wang discovered that the ASN.1 decoding routines in CIFS and SNMP NAT did not correctly handle certain length values. Remote attackers could exploit this to execute arbitrary code or crash the system.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| linux | ||
| linux-source-2.6.15 | ||
| linux-source-2.6.20 | ||
| linux-source-2.6.22 | ||
Patch details
| Package | Patch details |
|---|---|
| linux |