Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote…

Exploit prediction (EPSS)

8.44% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

• EDB-7100 Net-SNMP 5.1.4/5.2.4/5.4.1 Perl Module - Buffer Overflow (PoC) · dos · 2008-11-12

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• securitytracker.com /id?1020527 · vdb-entry, x_refsource_SECTRACK, x_transferred
• secunia.com /advisories/30615 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• secunia.com /advisories/32664 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• lists.opensuse.org /opensuse-security-announce/2008-08/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred
• secunia.com /advisories/30187 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• secunia.com /advisories/31351 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• support.avaya.com /elmodocs2/security/ASA-2008-282.htm · x_refsource_CONFIRM, x_transferred
• sourceforge.net /tracker/index.php?func=detail&aid=1826174&group_id=12694&atid=112694 · x_refsource_CONFIRM, x_transferred
• redhat.com /archives/fedora-package-announce/2008-June/msg00363.html · vendor-advisory, x_refsource_FEDORA, x_transferred
• secunia.com /advisories/31334 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• vupen.com /english/advisories/2008/2141/references · vdb-entry, x_refsource_VUPEN, x_transferred
• secunia.com /advisories/30647 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• securityfocus.com /bid/29212 · vdb-entry, x_refsource_BID, x_transferred
• secunia.com /advisories/33003 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• vupen.com /english/advisories/2008/2361 · vdb-entry, x_refsource_VUPEN, x_transferred
• secunia.com /advisories/31568 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• secunia.com /advisories/31467 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• sunsolve.sun.com /search/document.do?assetkey=1-26-239785-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
• debian.org /security/2008/dsa-1663 · vendor-advisory, x_refsource_DEBIAN, x_transferred
• redhat.com /support/errata/RHSA-2008-0529.html · vendor-advisory, x_refsource_REDHAT, x_transferred
• vmware.com /security/advisories/VMSA-2008-0013.html · x_refsource_CONFIRM, x_transferred
• secunia.com /advisories/31155 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• security.gentoo.org /glsa/glsa-200808-02.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/42430 · vdb-entry, x_refsource_XF, x_transferred
• redhat.com /archives/fedora-package-announce/2008-June/msg00459.html · vendor-advisory, x_refsource_FEDORA, x_transferred
• redhat.com /archives/fedora-package-announce/2008-June/msg00380.html · vendor-advisory, x_refsource_FEDORA, x_transferred
• mandriva.com /security/advisories?name=MDVSA-2008:118 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
• ubuntu.com /usn/usn-685-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
• vupen.com /english/advisories/2008/1528/references · vdb-entry, x_refsource_VUPEN, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11261 · vdb-entry, signature, x_refsource_OVAL, x_transferred

Sources

• CVE List: CVE-2008-2292
• NVD: CVE-2008-2292

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.