|
 |
| SecurityReason | ||
| WLB | ||
| RSS | ||
| Corporate | ||
| Services | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityAlert | ||||
 SecurityAlert : 3933 CVE : CVE-2008-0960 CWE : CWE-287 SecurityRisk : Medium  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Given : No Credit : Andrea Barisani Published : 13.06.2008
Advisory Text : 2008/06/09 #2008-006 multiple SNMP implementations HMAC authentication spoofing Description: Some SNMP implementations include incomplete HMAC authentication code that allows spoofing of authenticated SNMPv3 packets. The authentication code reads the length to be checked from sender input, this allows the sender to supply single byte HMAC code and have a 1 in 256 chance of matching the correct HMAC and authenticating, as only the first byte will be checked. The sender would need to know a valid username. Currently Net-SNMP and UCD-SNMP are known to be vulnerable, other SNMP implementations may also be affected. The eCos project includes code derived from UCD-SNMP and is therefore also affected. Affected version: Net-SNMP <= 5.4.1, <= 5.3.2, <= 5.2.4 UCD-SNMP, all versions eCos, all versions Fixed version: Net-SNMP >= 5.4.1.1, >= 5.3.2.1, >= 5.2.4.1 UCD-SNMP, N/A eCos, N/A Credit: this issue was reported by CERT/CC, it is tracked as VU#878044. CVE: CVE-2008-0960 Timeline: 2008-06-05: CERT/CC reports VU#878044 to oCERT requesting joint coordination 2008-06-05: contacted affected vendors 2008-06-06: added eCos to affected packages 2008-06-09: patched net-snmp packages released 2008-06-09: advisory release References: http://sourceforge.net/forum/forum.php?forum_id=833770 http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_i d=12694&atid=456380 http://www.kb.cert.org/vuls/id/878044 Links: http://www.net-snmp.org http://www.ece.ucdavis.edu/ucd-snmp http://ecos.sourceware.org Permalink: http://www.ocert.org/advisories/ocert-2008-006.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate" References : http://www.kb.cert.org/vuls/id/MIMG-7ETS87 http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q http://www.kb.cert.org/vuls/id/878044 https://bugzilla.redhat.com/show_bug.cgi?id=447974 http://www.securityfocus.com/bid/29623 http://www.securityfocus.com/archive/1/archive/1/493218/100/0/threaded http://www.openwall.com/lists/oss-security/2008/06/09/1 http://www.ocert.org/advisories/ocert-2008-006.html http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&gr oup_id=12694&atid=456380 http://sourceforge.net/forum/forum.php?forum_id=833770 http://secunia.com/advisories/30596 http://secunia.com/advisories/30574 http://rhn.redhat.com/errata/RHSA-2008-0528.html Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
*BSD libc (strfmon) Multiple vulnerabilities
Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected *BSD systems. |
||
| Apache |  |
|
» Apache Tomcat <= |
||
| PHP | |
|
» PHP 5.2.5 and prior : |
||
- 2008-03-25| Copyright © SecurityReason. All Rights Reserved. |