Vulnerabilities > CVE-2009-1887 - Divide By Zero vulnerability in Net-Snmp 5.0.9
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 | |
OS | 1 |
Common Weakness Enumeration (CWE)
Nessus
NASL family Scientific Linux Local Security Checks NASL id SL_20090625_NET_SNMP_ON_SL3_X.NASL description A divide-by-zero flaw was discovered in the snmpd daemon. A remote attacker could issue a specially crafted GETBULK request that could crash the snmpd daemon. (CVE-2009-1887) Note: An attacker must have read access to the SNMP server in order to exploit this flaw. In the default configuration, the community name last seen 2020-06-01 modified 2020-06-02 plugin id 60607 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60607 title Scientific Linux Security Update : net-snmp on SL3.x i386/x86_64 NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1124.NASL description Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A divide-by-zero flaw was discovered in the snmpd daemon. A remote attacker could issue a specially crafted GETBULK request that could crash the snmpd daemon. (CVE-2009-1887) Note: An attacker must have read access to the SNMP server in order to exploit this flaw. In the default configuration, the community name last seen 2020-06-01 modified 2020-06-02 plugin id 39523 published 2009-06-26 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/39523 title CentOS 3 : net-snmp (CESA-2009:1124) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1124.NASL description From Red Hat Security Advisory 2009:1124 : Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A divide-by-zero flaw was discovered in the snmpd daemon. A remote attacker could issue a specially crafted GETBULK request that could crash the snmpd daemon. (CVE-2009-1887) Note: An attacker must have read access to the SNMP server in order to exploit this flaw. In the default configuration, the community name last seen 2020-06-01 modified 2020-06-02 plugin id 67880 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67880 title Oracle Linux 3 : net-snmp (ELSA-2009-1124) NASL family VMware ESX Local Security Checks NASL id VMWARE_VMSA-2010-0003.NASL description a. Service Console package net-snmp updated This patch updates the service console package for net-snmp, net-snmp-utils, and net-snmp-libs to version net-snmp-5.0.9-2.30E.28. This net-snmp update fixes a divide-by- zero flaw in the snmpd daemon. A remote attacker could issue a specially crafted GETBULK request that could cause the snmpd daemon to fail. This vulnerability was introduced by an incorrect fix for CVE-2008-4309. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-1887 to this issue. Note: After installing the previous patch for net-snmp (ESX350-200901409-SG), running the snmpbulkwalk command with the parameter -CnX results in no output, and the snmpd daemon stops. last seen 2020-06-01 modified 2020-06-02 plugin id 44642 published 2010-02-17 reporter This script is Copyright (C) 2010-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44642 title VMSA-2010-0003 : ESX Service Console update for net-snmp NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1124.NASL description Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A divide-by-zero flaw was discovered in the snmpd daemon. A remote attacker could issue a specially crafted GETBULK request that could crash the snmpd daemon. (CVE-2009-1887) Note: An attacker must have read access to the SNMP server in order to exploit this flaw. In the default configuration, the community name last seen 2020-06-01 modified 2020-06-02 plugin id 39527 published 2009-06-26 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/39527 title RHEL 3 : net-snmp (RHSA-2009:1124)
Oval
accepted 2010-06-07T04:01:11.391-04:00 class vulnerability contributors name Pai Peng organization Hewlett-Packard definition_extensions comment VMware ESX Server 3.5.0 is installed oval oval:org.mitre.oval:def:5887 comment VMWare ESX Server 3.0.3 is installed oval oval:org.mitre.oval:def:6026
description agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309. family unix id oval:org.mitre.oval:def:8426 status accepted submitted 2010-03-18T13:00:53.000-04:00 title VMware net-snmp divide-by-zero vulnerability version 4 accepted 2013-04-29T04:21:33.956-04:00 class vulnerability contributors name Aharon Chernin organization SCAP.com, LLC name Dragos Prisaca organization G2, Inc.
definition_extensions comment The operating system installed on the system is Red Hat Enterprise Linux 3 oval oval:org.mitre.oval:def:11782 comment CentOS Linux 3.x oval oval:org.mitre.oval:def:16651
description agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309. family unix id oval:org.mitre.oval:def:9716 status accepted submitted 2010-07-09T03:56:16-04:00 title agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309. version 26
Redhat
advisories |
| ||||
rpms |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=506903
- http://www.redhat.com/support/errata/RHSA-2009-1124.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:156
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9716
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8426