CVE-2008-1673: debian debian_linux

Modified

Published 10-06-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1673 is a high (CVSS 10.0) vulnerability in debian debian_linux. EPSS estimates a 7.09% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 10, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

7.09%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

DSA-1592-1

Timeline

10-06-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

7.09%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.09% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

debian_linuxEOL4.0

Linux1 product

linux_kernel2.4.0 | 2.4.0:test1 | 2.4.0:test10 | 2.4.0:test11 | 2.4.0:test12 | 2.4.0:test2 | 2.4.0:test3 | 2.4.0:test4 | 2.4.0:test5 | 2.4.0:test6 | 2.4.0:test7 | 2.4.0:test8 | 2.4.0:test9 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.5 | 2.4.6 | 2.4.7 | 2.4.8 | 2.4.9 | 2.4.10 | 2.4.11 | 2.4.12 | 2.4.13 | 2.4.14 | 2.4.15 | 2.4.16 | 2.4.17 | 2.4.18 | 2.4.18:pre1 | 2.4.18:pre2 | 2.4.18:pre3 | 2.4.18:pre4 | 2.4.18:pre5 | 2.4.18:pre6 | 2.4.18:pre7 | 2.4.18:pre8 | 2.4.19 | 2.4.19:pre1 | 2.4.19:pre2 | 2.4.19:pre3 | 2.4.19:pre4 | 2.4.19:pre5 | 2.4.19:pre6 | 2.4.20 | 2.4.21 | 2.4.21:pre1 | 2.4.21:pre4 | 2.4.21:pre7 | 2.4.22 | 2.4.23 | 2.4.23:pre9 | 2.4.23_ow2 | 2.4.24 | 2.4.24_ow1 | 2.4.25 | 2.4.26 | 2.4.27 | 2.4.27:pre1 | 2.4.27:pre2 | 2.4.27:pre3 | 2.4.27:pre4 | 2.4.27:pre5 | 2.4.28 | 2.4.29 | 2.4.29:rc1 | 2.4.29:rc2 | 2.4.30 | 2.4.30:rc2 | 2.4.30:rc3 | 2.4.31 | 2.4.31:pre1 | 2.4.32 | 2.4.32:pre1 | 2.4.32:pre2 | 2.4.33 | 2.4.33:pre1 | 2.4.33.2 | 2.4.33.3 | 2.4.33.4 | 2.4.33.5 | 2.4.34 | 2.4.35 | 2.4.36 | 2.4.36.1 | 2.4.36.2 | 2.4.36.3 | 2.4.36.4 | 2.4.36.5 | 2.6.0 | 2.6.0:test1 | 2.6.0:test2 | 2.6.0:test3 | 2.6.0:test4 | 2.6.0:test5 | 2.6.0:test6 | 2.6.0:test7 | 2.6.0:test8 | 2.6.0:test9 | 2.6.1 | 2.6.1:rc1 | 2.6.1:rc2 | 2.6.2 | 2.6.10 | 2.6.10:rc2 | 2.6.11 | 2.6.11:rc2 | 2.6.11:rc3 | 2.6.11:rc4 | 2.6.11.4 | 2.6.11.5 | 2.6.11.6 | 2.6.11.7 | 2.6.11.8 | 2.6.11.11 | 2.6.11.12 | 2.6.12 | 2.6.12:rc1 | 2.6.12:rc4 | 2.6.12:rc5 | 2.6.12.1 | 2.6.12.2 | 2.6.12.3 | 2.6.12.4 | 2.6.12.5 | 2.6.12.6 | 2.6.12.12 | 2.6.12.22 | 2.6.13 | 2.6.13:rc1 | 2.6.13:rc4 | 2.6.13:rc6 | 2.6.13:rc7 | 2.6.13.1 | 2.6.13.2 | 2.6.13.3 | 2.6.13.4 | 2.6.14 | 2.6.14:rc1 | 2.6.14:rc2 | 2.6.14:rc3 | 2.6.14:rc4 | 2.6.14.1 | 2.6.14.2 | 2.6.14.3 | 2.6.14.4 | 2.6.14.5 | 2.6.15 | 2.6.15:rc1 | 2.6.15:rc2 | 2.6.15:rc3 | 2.6.15.1 | 2.6.15.2 | 2.6.15.3 | 2.6.15.4 | 2.6.15.5 | 2.6.15.11 | 2.6.16 | 2.6.16:rc1 | 2.6.16.1 | 2.6.16.7 | 2.6.16.9 | 2.6.16.11 | 2.6.16.12 | 2.6.16.13 | 2.6.16.19 | 2.6.16.23 | 2.6.16.27 | 2.6.17 | 2.6.17:rc5 | 2.6.17.1 | 2.6.17.2 | 2.6.17.3 | 2.6.17.5 | 2.6.17.6 | 2.6.17.7 | 2.6.17.8 | 2.6.17.10 | 2.6.17.11 | 2.6.17.12 | 2.6.17.13 | 2.6.17.14 | 2.6.18 | 2.6.18.1 | 2.6.18.3 | 2.6.18.4 | 2.6.19 | 2.6.19:rc1 | 2.6.19:rc2 | 2.6.19:rc3 | 2.6.19:rc4 | 2.6.19.1 | 2.6.19.2 | 2.6.20 | 2.6.20:rc2 | 2.6.20.1 | 2.6.20.2 | 2.6.20.3 | 2.6.20.4 | 2.6.20.5 | 2.6.20.8 | 2.6.20.9 | 2.6.20.11 | 2.6.20.13 | 2.6.20.15 | 2.6.21 | 2.6.21:rc3 | 2.6.21:rc4 | 2.6.21:rc5 | 2.6.21:rc6 | 2.6.21.1 | 2.6.21.2 | 2.6.21.6 | 2.6.21.7 | 2.6.22 | 2.6.22.1 | 2.6.22.3 | 2.6.22.4 | 2.6.22.5 | 2.6.22.6 | 2.6.22.7 | 2.6.22.8 | 2.6.22.11 | 2.6.22.12 | 2.6.22.13 | 2.6.22.14 | 2.6.22.15 | 2.6.22.16 | 2.6.22.17 | 2.6.22_rc1 | 2.6.22_rc7 | 2.6.23 | 2.6.23:rc1 | 2.6.23:rc2 | 2.6.23.1 | 2.6.23.2 | 2.6.23.3 | 2.6.23.4 | 2.6.23.5 | 2.6.23.6 | 2.6.23.7 | 2.6.23.9 | 2.6.23.10 | 2.6.23.14 | 2.6.24:rc2 | 2.6.24:rc3 | 2.6.24.1 | 2.6.24.2 | 2.6.24.6 | 2.6.24_rc1 | 2.6.25 | 2.6.25.1 | 2.6.25.2 | 2.6.25.3 | 2.6.25.4 | 2.6_test9_cvs

2 vendors · 2 products

References

34 links

lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/30000Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30658Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/wiki/Advisories:rPSA-2008-0189X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/bid/29589VDB EntryX Refsource BIDPatch
git.kernel.orgX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/archives/fedora-package-announce/2008-June/msg00587.htmlVendor AdvisoryX Refsource FEDORA

Show all 34 references

secunia.com/advisories/32104Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30982Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30580Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/493300/100/0/threadedMailing ListX Refsource BUGTRAQ
exchange.xforce.ibmcloud.com/vulnerabilities/42921VDB EntryX Refsource XF
secunia.com/advisories/30644Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/32103Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:113Vendor AdvisoryX Refsource MANDRIVA
www.securitytracker.com/id?1020210VDB EntryX Refsource SECTRACK
www.mandriva.com/security/advisories?name=MDVSA-2008:174Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/32759Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1770VDB EntryX Refsource VUPEN
secunia.com/advisories/31107Third Party AdvisoryX Refsource SECUNIA
kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5X Refsource CONFIRM
secunia.com/advisories/32370Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31836Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-625-1Vendor AdvisoryX Refsource UBUNTU
bugzilla.redhat.com/show_bug.cgi?id=443962X Refsource CONFIRM
www.debian.org/security/2008/dsa-1592Vendor AdvisoryX Refsource DEBIAN
lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlVendor AdvisoryX Refsource SUSE
git.kernel.orgX Refsource CONFIRM
kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.6X Refsource CONFIRM