CVE-2008-4309

High

Published: 31/10/2008(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Heap buffer overflow in the netsnmp_create_subtree_cache function in net-snmp before version 5.4.2.1, 5.3.2.3, and 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request.

Risk Assessment

Attackers can exploit this vulnerability to remotely crash the SNMP server, leading to service unavailability.

Recommendation

It is recommended to upgrade to the latest version of net-snmp to mitigate this vulnerability.

Other vulnerabilities in net-snmp

CVE-2015-5621High
The snmp_pdu_parse function in net-snmp version 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails. This allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

Original NVD description (English source)

Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.