01 Record

CVE-2008-0960

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0

UnratedPUBLISHEDCNA: certcc

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 68.79% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 99.2% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2008-06-10 18:00Z18 YR AGO

Last updated

2024-08-07 08:01Z2 YR AGO

Reserved

2008-02-25

Assigning CNA

certcc

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-287Improper AuthenticationClass

Data version

5.1

Document digest

720f433e0be1934114d5915c28aaf447e0083c4d40988c76947fcc320dc3eecd

05 Affected products

VendorProductVersionsPlatforms

ciscoace_10_6504_bundle_with_4_gbps_throughputNot specified—

ciscoace_10_6509_bundle_with_8_gbps_throughputNot specified—

ciscoace_10_service_moduleNot specified—

ciscoace_20_6504_bundle_with__4gbps_throughputNot specified—

ciscoace_20_6509_bundle_with_8gbps_throughputNot specified—

ciscoace_20_service_moduleNot specified—

ciscoace_4710Not specified—

ciscoace_xml_gatewayNot specified—

ciscocatosNot specified—

ciscocisco_iosNot specified—

ciscoiosNot specified—

ciscoios_xrNot specified—

ciscomds_9120Not specified—

ciscomds_9124Not specified—

ciscomds_9134Not specified—

ciscomds_9140Not specified—

cisconx_osNot specified—

ecos_sourcewareecosNot specified—

ingateingate_firewallNot specified—

ingateingate_siparatorNot specified—

junipersession_and_resource_controlNot specified—

junipersrc_peNot specified—

net-snmpnet_snmpNot specified—

redhatenterprise_linuxNot specified—

redhatrhel_eusNot specified—

sunsolarisNot specified—

sunsunosNot specified—

06 References

sourceforge.nethttp://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380x_refsource_CONFIRM
secunia.com35463http://secunia.com/advisories/35463third-party-advisoryx_refsource_SECUNIA
secunia.com30615http://secunia.com/advisories/30615third-party-advisoryx_refsource_SECUNIA
support.apple.comhttp://support.apple.com/kb/HT2163x_refsource_CONFIRM
www.vupen.comADV-2008-1787http://www.vupen.com/english/advisories/2008/1787/referencesvdb-entryx_refsource_VUPEN
secunia.com30648http://secunia.com/advisories/30648third-party-advisoryx_refsource_SECUNIA
www.kb.cert.orghttp://www.kb.cert.org/vuls/id/CTAR-7FBS8Qx_refsource_CONFIRM
secunia.com32664http://secunia.com/advisories/32664third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2008-1981http://www.vupen.com/english/advisories/2008/1981/referencesvdb-entryx_refsource_VUPEN
www.vupen.comADV-2008-1801http://www.vupen.com/english/advisories/2008/1801/referencesvdb-entryx_refsource_VUPEN
lists.opensuse.orgSUSE-SA:2008:039http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.htmlvendor-advisoryx_refsource_SUSE
lists.ingate.com[productinfo] 20080611 Ingate Firewall and SIParator affected by SNMPv3 vulnerabilityhttp://lists.ingate.com/pipermail/productinfo/2008/000021.htmlmailing-listx_refsource_MLIST
secunia.com31351http://secunia.com/advisories/31351third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2008-1788http://www.vupen.com/english/advisories/2008/1788/referencesvdb-entryx_refsource_VUPEN
support.avaya.comhttp://support.avaya.com/elmodocs2/security/ASA-2008-282.htmx_refsource_CONFIRM
www.redhat.comFEDORA-2008-5215https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.htmlvendor-advisoryx_refsource_FEDORA
www.securityfocus.com29623http://www.securityfocus.com/bid/29623vdb-entryx_refsource_BID
secunia.com31334http://secunia.com/advisories/31334third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2008-2971http://www.vupen.com/english/advisories/2008/2971vdb-entryx_refsource_VUPEN
oval.cisecurity.orgoval:org.mitre.oval:def:10820https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820vdb-entrysignaturex_refsource_OVAL
oval.cisecurity.orgoval:org.mitre.oval:def:6414https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414vdb-entrysignaturex_refsource_OVAL
secunia.com30626http://secunia.com/advisories/30626third-party-advisoryx_refsource_SECUNIA
marc.infoSSRT080082http://marc.info/?l=bugtraq&m=127730470825399&w=2vendor-advisoryx_refsource_HP
www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2008-0017.htmlx_refsource_MISC
www.openwall.com[oss-security] 20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofinghttp://www.openwall.com/lists/oss-security/2008/06/09/1mailing-listx_refsource_MLIST
www.kb.cert.orgVU#878044http://www.kb.cert.org/vuls/id/878044third-party-advisoryx_refsource_CERT-VN
secunia.com30647http://secunia.com/advisories/30647third-party-advisoryx_refsource_SECUNIA
sunsolve.sun.com238865http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1vendor-advisoryx_refsource_SUNALERT
www.securityfocus.com20081031 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiffhttp://www.securityfocus.com/archive/1/497962/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.vupen.comADV-2008-1836http://www.vupen.com/english/advisories/2008/1836/referencesvdb-entryx_refsource_VUPEN
secunia.com33003http://secunia.com/advisories/33003third-party-advisoryx_refsource_SECUNIA
www.cisco.com20080610 SNMP Version 3 Authentication Vulnerabilitieshttp://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtmlvendor-advisoryx_refsource_CISCO
www.vupen.comADV-2008-2361http://www.vupen.com/english/advisories/2008/2361vdb-entryx_refsource_VUPEN
secunia.com31568http://secunia.com/advisories/31568third-party-advisoryx_refsource_SECUNIA
secunia.com31467http://secunia.com/advisories/31467third-party-advisoryx_refsource_SECUNIA
lists.apple.comAPPLE-SA-2008-06-30http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlvendor-advisoryx_refsource_APPLE
www.debian.orgDSA-1663http://www.debian.org/security/2008/dsa-1663vendor-advisoryx_refsource_DEBIAN
www.us-cert.govTA08-162Ahttp://www.us-cert.gov/cas/techalerts/TA08-162A.htmlthird-party-advisoryx_refsource_CERT
www.kb.cert.orghttp://www.kb.cert.org/vuls/id/MIMG-7ETS87x_refsource_CONFIRM
www.ocert.orghttp://www.ocert.org/advisories/ocert-2008-006.htmlx_refsource_MISC
rhn.redhat.comRHSA-2008:0528http://rhn.redhat.com/errata/RHSA-2008-0528.htmlvendor-advisoryx_refsource_REDHAT
securityreason.com3933http://securityreason.com/securityalert/3933third-party-advisoryx_refsource_SREASON
www.redhat.comRHSA-2008:0529http://www.redhat.com/support/errata/RHSA-2008-0529.htmlvendor-advisoryx_refsource_REDHAT
secunia.com30612http://secunia.com/advisories/30612third-party-advisoryx_refsource_SECUNIA
secunia.com30802http://secunia.com/advisories/30802third-party-advisoryx_refsource_SECUNIA
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=447974x_refsource_CONFIRM
www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2008-0013.htmlx_refsource_CONFIRM
www.kb.cert.orghttp://www.kb.cert.org/vuls/id/MIMG-7ETS5Zx_refsource_CONFIRM
www.exploit-db.com5790https://www.exploit-db.com/exploits/5790exploitx_refsource_EXPLOIT-DB
www.vupen.comADV-2008-1797http://www.vupen.com/english/advisories/2008/1797/referencesvdb-entryx_refsource_VUPEN
security.gentoo.orgGLSA-200808-02http://security.gentoo.org/glsa/glsa-200808-02.xmlvendor-advisoryx_refsource_GENTOO
www.securityfocus.com20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofinghttp://www.securityfocus.com/archive/1/493218/100/0/threadedmailing-listx_refsource_BUGTRAQ
secunia.com30665http://secunia.com/advisories/30665third-party-advisoryx_refsource_SECUNIA
www.redhat.comFEDORA-2008-5218https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.htmlvendor-advisoryx_refsource_FEDORA
www.redhat.comFEDORA-2008-5224https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.htmlvendor-advisoryx_refsource_FEDORA
www.vupen.comADV-2008-1800http://www.vupen.com/english/advisories/2008/1800/referencesvdb-entryx_refsource_VUPEN
www.mandriva.comMDVSA-2008:118http://www.mandriva.com/security/advisories?name=MDVSA-2008:118vendor-advisoryx_refsource_MANDRIVA
www.ubuntu.comUSN-685-1http://www.ubuntu.com/usn/usn-685-1vendor-advisoryx_refsource_UBUNTU
sourceforge.nethttp://sourceforge.net/forum/forum.php?forum_id=833770x_refsource_CONFIRM
www.securitytracker.com1020218http://www.securitytracker.com/id?1020218vdb-entryx_refsource_SECTRACK
secunia.com30596http://secunia.com/advisories/30596third-party-advisoryx_refsource_SECUNIA
oval.cisecurity.orgoval:org.mitre.oval:def:5785https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785vdb-entrysignaturex_refsource_OVAL
www.vupen.comADV-2009-1612http://www.vupen.com/english/advisories/2009/1612vdb-entryx_refsource_VUPEN
secunia.com30574http://secunia.com/advisories/30574third-party-advisoryx_refsource_SECUNIA

07 Fixed in

Debian 12

net-snmp
Fixed in 5.4.1~dfsg-8.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

net-snmp
Fixed in 5.4.1~dfsg-8.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

net-snmp
Fixed in 5.4.1~dfsg-8.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.