CVE-2008-0960

Exploit

EPSS 68.79%
Veröffentlicht 10.06.2008 18:32:00
Zuletzt bearbeitet 16.06.2026 22:50:41
Erkennungen
Login

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 67

NVD 4 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Session And Resource Control Version 1.0

   Cisco ≫ Catos Version 7.1.1
   Cisco ≫ Catos Version 7.3.1
   Cisco ≫ Catos Version 7.4.1
   Cisco ≫ Catos Version 8.3
   Cisco ≫ Cisco Ios Version 12.0 Update s
   Cisco ≫ Cisco Ios Version 12.0 Update sy
   Cisco ≫ Cisco Ios Version 12.1 Update e
   Cisco ≫ Cisco Ios Version 12.2 Update ewa
   Cisco ≫ Cisco Ios Version 12.2 Update jk
   Cisco ≫ Cisco Ios Version 12.2 Update sb
   Cisco ≫ Cisco Ios Version 12.2 Update sg
   Cisco ≫ Cisco Ios Version 12.2 Update sga
   Cisco ≫ Cisco Ios Version 12.2 Update sra
   Cisco ≫ Cisco Ios Version 12.2 Update srb
   Cisco ≫ Cisco Ios Version 12.2 Update src
   Cisco ≫ Cisco Ios Version 12.2 Update sxb
   Cisco ≫ Cisco Ios Version 12.2 Update sxd
   Cisco ≫ Cisco Ios Version 12.2 Update sxf
   Cisco ≫ Cisco Ios Version 12.2 Update zl
   Cisco ≫ Cisco Ios Version 12.2 Update zy
   Cisco ≫ Cisco Ios Version 12.3
   Cisco ≫ Cisco Ios Version 12.3 Update b
   Cisco ≫ Cisco Ios Version 12.3 Update ja
   Cisco ≫ Cisco Ios Version 12.3 Update jeb
   Cisco ≫ Cisco Ios Version 12.3 Update jk
   Cisco ≫ Cisco Ios Version 12.3 Update jl
   Cisco ≫ Cisco Ios Version 12.3 Update jx
   Cisco ≫ Cisco Ios Version 12.3 Update t
   Cisco ≫ Cisco Ios Version 12.3 Update xa
   Cisco ≫ Cisco Ios Version 12.3 Update xg
   Cisco ≫ Cisco Ios Version 12.3 Update xi
   Cisco ≫ Cisco Ios Version 12.3 Update xk
   Cisco ≫ Cisco Ios Version 12.3 Update xr
   Cisco ≫ Cisco Ios Version 12.3 Update yf
   Cisco ≫ Cisco Ios Version 12.3 Update yi
   Cisco ≫ Cisco Ios Version 12.3 Update yt
   Cisco ≫ Cisco Ios Version 12.3 Update yx
   Cisco ≫ Cisco Ios Version 12.4
   Cisco ≫ Cisco Ios Version 12.4 Update t
   Cisco ≫ Cisco Ios Version 12.4 Update xa
   Cisco ≫ Cisco Ios Version 12.4 Update xc
   Cisco ≫ Cisco Ios Version 12.4 Update xd
   Cisco ≫ Cisco Ios Version 12.4 Update xe
   Cisco ≫ Cisco Ios Version 12.4 Update xj
   Cisco ≫ Cisco Ios Version 12.4 Update xw
   Cisco ≫ Ios Version 10.0
   Cisco ≫ Ios Version 11.0
   Cisco ≫ Ios Version 11.1
   Cisco ≫ Ios Version 11.3
   Cisco ≫ Ios Version 12.2
   Cisco ≫ Ios Xr Version 2.0
   Cisco ≫ Ios Xr Version 3.0
   Cisco ≫ Ios Xr Version 3.2
   Cisco ≫ Ios Xr Version 3.3
   Cisco ≫ Ios Xr Version 3.4
   Cisco ≫ Ios Xr Version 3.5
   Cisco ≫ Ios Xr Version 3.6
   Cisco ≫ Ios Xr Version 3.7
   Cisco ≫ Nx Os Version 4.0
   Cisco ≫ Nx Os Version 4.0.1 Update a
   Cisco ≫ Nx Os Version 4.0.2
   Ecos Sourceware ≫ Ecos Version 1.1
   Ecos Sourceware ≫ Ecos Version 1.2.1
   Ecos Sourceware ≫ Ecos Version 1.3.1
   Ecos Sourceware ≫ Ecos Version 2.0
   Ecos Sourceware ≫ Ecos Version 2.0 Update b1
   Net-snmp ≫ Net Snmp Version 5.0
   Net-snmp ≫ Net Snmp Version 5.0.1
   Net-snmp ≫ Net Snmp Version 5.0.2
   Net-snmp ≫ Net Snmp Version 5.0.3
   Net-snmp ≫ Net Snmp Version 5.0.4
   Net-snmp ≫ Net Snmp Version 5.0.5
   Net-snmp ≫ Net Snmp Version 5.0.6
   Net-snmp ≫ Net Snmp Version 5.0.7
   Net-snmp ≫ Net Snmp Version 5.0.8
   Net-snmp ≫ Net Snmp Version 5.0.9
   Net-snmp ≫ Net Snmp Version 5.1
   Net-snmp ≫ Net Snmp Version 5.1.1
   Net-snmp ≫ Net Snmp Version 5.1.2
   Net-snmp ≫ Net Snmp Version 5.2
   Net-snmp ≫ Net Snmp Version 5.3
   Net-snmp ≫ Net Snmp Version 5.3.0.1
   Net-snmp ≫ Net Snmp Version 5.4
   Sun ≫ Solaris Version 10.0 Update unkown Edition x86
   Sun ≫ Sunos Version 5.10
   Cisco ≫ Ace 10 6504 Bundle With 4 Gbps Throughput
   Cisco ≫ Ace 10 6509 Bundle With 8 Gbps Throughput
   Cisco ≫ Ace 10 Service Module
   Cisco ≫ Ace 20 6504 Bundle With 4gbps Throughput
   Cisco ≫ Ace 20 6509 Bundle With 8gbps Throughput
   Cisco ≫ Ace 20 Service Module
   Cisco ≫ Ace 4710
   Cisco ≫ Ace Xml Gateway Version 5.2
   Cisco ≫ Ace Xml Gateway Version 6.0
   Cisco ≫ Mds 9120
   Cisco ≫ Mds 9124
   Cisco ≫ Mds 9134
   Cisco ≫ Mds 9140
   Ingate ≫ Ingate Firewall Version 2.2.0
   Ingate ≫ Ingate Firewall Version 2.2.1
   Ingate ≫ Ingate Firewall Version 2.2.2
   Ingate ≫ Ingate Firewall Version 2.3.0
   Ingate ≫ Ingate Firewall Version 2.4.0
   Ingate ≫ Ingate Firewall Version 2.4.1
   Ingate ≫ Ingate Firewall Version 2.5.0
   Ingate ≫ Ingate Firewall Version 2.6.0
   Ingate ≫ Ingate Firewall Version 2.6.1
   Ingate ≫ Ingate Firewall Version 3.0.2
   Ingate ≫ Ingate Firewall Version 3.1.0
   Ingate ≫ Ingate Firewall Version 3.1.1
   Ingate ≫ Ingate Firewall Version 3.1.3
   Ingate ≫ Ingate Firewall Version 3.1.4
   Ingate ≫ Ingate Firewall Version 3.2.0
   Ingate ≫ Ingate Firewall Version 3.2.1
   Ingate ≫ Ingate Firewall Version 3.2.2
   Ingate ≫ Ingate Firewall Version 3.3.1
   Ingate ≫ Ingate Firewall Version 4.1.0
   Ingate ≫ Ingate Firewall Version 4.1.3
   Ingate ≫ Ingate Firewall Version 4.2.1
   Ingate ≫ Ingate Firewall Version 4.2.2
   Ingate ≫ Ingate Firewall Version 4.2.3
   Ingate ≫ Ingate Firewall Version 4.3.1
   Ingate ≫ Ingate Firewall Version 4.4.1
   Ingate ≫ Ingate Firewall Version 4.4.2
   Ingate ≫ Ingate Firewall Version 4.5.1
   Ingate ≫ Ingate Firewall Version 4.5.2
   Ingate ≫ Ingate Firewall Version 4.6.0
   Ingate ≫ Ingate Firewall Version 4.6.1
   Ingate ≫ Ingate Firewall Version 4.6.2
   Ingate ≫ Ingate Siparator Version 2.2.0
   Ingate ≫ Ingate Siparator Version 2.2.1
   Ingate ≫ Ingate Siparator Version 2.2.2
   Ingate ≫ Ingate Siparator Version 2.3.0
   Ingate ≫ Ingate Siparator Version 2.4.0
   Ingate ≫ Ingate Siparator Version 2.4.1
   Ingate ≫ Ingate Siparator Version 2.5.0
   Ingate ≫ Ingate Siparator Version 2.6.0
   Ingate ≫ Ingate Siparator Version 2.6.1
   Ingate ≫ Ingate Siparator Version 3.0.2
   Ingate ≫ Ingate Siparator Version 3.1.0
   Ingate ≫ Ingate Siparator Version 3.1.1
   Ingate ≫ Ingate Siparator Version 3.1.3
   Ingate ≫ Ingate Siparator Version 3.1.4
   Ingate ≫ Ingate Siparator Version 3.2.0
   Ingate ≫ Ingate Siparator Version 3.2.1
   Ingate ≫ Ingate Siparator Version 3.2.2
   Ingate ≫ Ingate Siparator Version 3.3.1
   Ingate ≫ Ingate Siparator Version 4.1.0
   Ingate ≫ Ingate Siparator Version 4.1.3
   Ingate ≫ Ingate Siparator Version 4.2.1
   Ingate ≫ Ingate Siparator Version 4.2.2
   Ingate ≫ Ingate Siparator Version 4.2.3
   Ingate ≫ Ingate Siparator Version 4.3.1
   Ingate ≫ Ingate Siparator Version 4.3.4
   Ingate ≫ Ingate Siparator Version 4.4.1
   Ingate ≫ Ingate Siparator Version 4.4.2
   Ingate ≫ Ingate Siparator Version 4.5.1
   Ingate ≫ Ingate Siparator Version 4.5.2
   Ingate ≫ Ingate Siparator Version 4.6.0
   Ingate ≫ Ingate Siparator Version 4.6.1
   Ingate ≫ Ingate Siparator Version 4.6.2

Juniper ≫ Session And Resource Control Version 2.0

Juniper ≫ Src Pe Version 1.0

Juniper ≫ Src Pe Version 2.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	68.79%	0.993

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

http://secunia.com/advisories/30802

Vendor Advisory

http://support.apple.com/kb/HT2163

http://www.vupen.com/english/advisories/2008/1981/references

http://secunia.com/advisories/31467

Vendor Advisory

http://www.vmware.com/security/advisories/VMSA-2008-0013.html

http://www.vupen.com/english/advisories/2008/2361

http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html

http://secunia.com/advisories/30615

Vendor Advisory

http://secunia.com/advisories/30647

Vendor Advisory

http://secunia.com/advisories/31334

Vendor Advisory

http://secunia.com/advisories/31351

Vendor Advisory

http://secunia.com/advisories/31568

Vendor Advisory

http://secunia.com/advisories/32664

Vendor Advisory

http://secunia.com/advisories/33003

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200808-02.xml

http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm

http://www.debian.org/security/2008/dsa-1663

Patch

http://www.mandriva.com/security/advisories?name=MDVSA-2008:118

http://www.redhat.com/support/errata/RHSA-2008-0529.html

http://www.ubuntu.com/usn/usn-685-1

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html

http://lists.ingate.com/pipermail/productinfo/2008/000021.html

http://marc.info/?l=bugtraq&m=127730470825399&w=2

http://rhn.redhat.com/errata/RHSA-2008-0528.html

http://secunia.com/advisories/30574

Vendor Advisory

http://secunia.com/advisories/30596

Vendor Advisory

http://secunia.com/advisories/30612

http://secunia.com/advisories/30626

Vendor Advisory

http://secunia.com/advisories/30648

Vendor Advisory

http://secunia.com/advisories/30665

Vendor Advisory

http://secunia.com/advisories/35463

http://securityreason.com/securityalert/3933

http://sourceforge.net/forum/forum.php?forum_id=833770

http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1

http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml

Vendor Advisory

http://www.kb.cert.org/vuls/id/878044

US Government Resource

http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q

US Government Resource

http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z

US Government Resource

http://www.kb.cert.org/vuls/id/MIMG-7ETS87

US Government Resource

http://www.ocert.org/advisories/ocert-2008-006.html

http://www.openwall.com/lists/oss-security/2008/06/09/1

http://www.securityfocus.com/archive/1/493218/100/0/threaded

http://www.securityfocus.com/archive/1/497962/100/0/threaded

http://www.securityfocus.com/bid/29623

Patch

Exploit

http://www.securitytracker.com/id?1020218

http://www.us-cert.gov/cas/techalerts/TA08-162A.html

US Government Resource

http://www.vmware.com/security/advisories/VMSA-2008-0017.html

http://www.vupen.com/english/advisories/2008/1787/references

http://www.vupen.com/english/advisories/2008/1788/references

http://www.vupen.com/english/advisories/2008/1797/references

http://www.vupen.com/english/advisories/2008/1800/references

http://www.vupen.com/english/advisories/2008/1801/references

http://www.vupen.com/english/advisories/2008/1836/references

http://www.vupen.com/english/advisories/2008/2971

http://www.vupen.com/english/advisories/2009/1612

https://bugzilla.redhat.com/show_bug.cgi?id=447974

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414

https://www.exploit-db.com/exploits/5790

https://nvd.nist.gov/vuln/detail/CVE-2008-0960

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2008-0960

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2008-0960

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2008-0960