CVE-2008-1673
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as...
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
Exploit likelihood
What each source reports
NVD Score used
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
- Record
CVE-2008-1673- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
- Record
CVE-2008-1673- Updated
- 2026-11-02
EUVDEUVD-2008-1674 No score
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
- Record
EUVD-2008-1674- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cf3p-m8mq-9rx8 No score
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as...
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
- Record
GHSA-cf3p-m8mq-9rx8- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:4.0 From an advisory covering 2 CVEs |
before 2.6.18.dfsg.1-18etch6, plus listed versions 2.6.18.dfsg.1-122.6.18.dfsg.1-12etch12.6.18.dfsg.1-12etch22.6.18.dfsg.1-132.6.18.dfsg.1-13etch1 Show 16 moreShow less2.6.18.dfsg.1-13etch22.6.18.dfsg.1-13etch32.6.18.dfsg.1-13etch42.6.18.dfsg.1-13etch52.6.18.dfsg.1-13etch62.6.18.dfsg.1-13lenny12.6.18.dfsg.1-142.6.18.dfsg.1-152.6.18.dfsg.1-162.6.18.dfsg.1-172.6.18.dfsg.1-17etch12.6.18.dfsg.1-182.6.18.dfsg.1-18etch12.6.18.dfsg.1-18etch32.6.18.dfsg.1-18etch42.6.18.dfsg.1-18etch5 |
2.6.18.dfsg.1-18etch6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1673 is a high vulnerability (CVSS 10.0) in Debian Linux, published June 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.09%, the 94th percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html
secunia.com/advisories/30000
wiki.rpath.com/wiki/Advisories:rPSA-2008-0189
securityfocus.com/bid/29589
Show 32 moreShow less
git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ddb2c43594f22843e9f3153da151deaba1a834c5
redhat.com/archives/fedora-package-announce/2008-June/msg00587.html
exchange.xforce.ibmcloud.com/vulnerabilities/42921
mandriva.com/security/advisories?name=MDVSA-2008:113
securitytracker.com/id?1020210
vupen.com/english/advisories/2008/1770
kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.5
ubuntu.com/usn/usn-625-1
bugzilla.redhat.com/show_bug.cgi?id=443962
debian.org/security/2008/dsa-1592
nvd.nist.gov/vuln/detail/CVE-2008-1673
github.com/advisories/GHSA-cf3p-m8mq-9rx8