NVD

CVE-2008-0960 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Current Description

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.

View Analysis Description

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 10.0 HIGH

Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
http://lists.ingate.com/pipermail/productinfo/2008/000021.html
http://lists.ingate.com/pipermail/productinfo/2008/000021.html
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html
http://marc.info/?l=bugtraq&m=127730470825399&w=2
http://marc.info/?l=bugtraq&m=127730470825399&w=2
http://marc.info/?l=bugtraq&m=127730470825399&w=2
http://marc.info/?l=bugtraq&m=127730470825399&w=2
http://rhn.redhat.com/errata/RHSA-2008-0528.html
http://rhn.redhat.com/errata/RHSA-2008-0528.html
http://secunia.com/advisories/30574	Vendor Advisory
http://secunia.com/advisories/30574	Vendor Advisory
http://secunia.com/advisories/30596	Vendor Advisory
http://secunia.com/advisories/30596	Vendor Advisory
http://secunia.com/advisories/30612
http://secunia.com/advisories/30612
http://secunia.com/advisories/30615	Vendor Advisory
http://secunia.com/advisories/30615	Vendor Advisory
http://secunia.com/advisories/30626	Vendor Advisory
http://secunia.com/advisories/30626	Vendor Advisory
http://secunia.com/advisories/30647	Vendor Advisory
http://secunia.com/advisories/30647	Vendor Advisory
http://secunia.com/advisories/30648	Vendor Advisory
http://secunia.com/advisories/30648	Vendor Advisory
http://secunia.com/advisories/30665	Vendor Advisory
http://secunia.com/advisories/30665	Vendor Advisory
http://secunia.com/advisories/30802	Vendor Advisory
http://secunia.com/advisories/30802	Vendor Advisory
http://secunia.com/advisories/31334	Vendor Advisory
http://secunia.com/advisories/31334	Vendor Advisory
http://secunia.com/advisories/31351	Vendor Advisory
http://secunia.com/advisories/31351	Vendor Advisory
http://secunia.com/advisories/31467	Vendor Advisory
http://secunia.com/advisories/31467	Vendor Advisory
http://secunia.com/advisories/31568	Vendor Advisory
http://secunia.com/advisories/31568	Vendor Advisory
http://secunia.com/advisories/32664	Vendor Advisory
http://secunia.com/advisories/32664	Vendor Advisory
http://secunia.com/advisories/33003	Vendor Advisory
http://secunia.com/advisories/33003	Vendor Advisory
http://secunia.com/advisories/35463
http://secunia.com/advisories/35463
http://security.gentoo.org/glsa/glsa-200808-02.xml
http://security.gentoo.org/glsa/glsa-200808-02.xml
http://securityreason.com/securityalert/3933
http://securityreason.com/securityalert/3933
http://sourceforge.net/forum/forum.php?forum_id=833770
http://sourceforge.net/forum/forum.php?forum_id=833770
http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380
http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1
http://support.apple.com/kb/HT2163
http://support.apple.com/kb/HT2163
http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm
http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm
http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml	Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml	Vendor Advisory
http://www.debian.org/security/2008/dsa-1663	Patch
http://www.debian.org/security/2008/dsa-1663	Patch
http://www.kb.cert.org/vuls/id/878044	US Government Resource
http://www.kb.cert.org/vuls/id/878044	US Government Resource
http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q	US Government Resource
http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q	US Government Resource
http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z	US Government Resource
http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z	US Government Resource
http://www.kb.cert.org/vuls/id/MIMG-7ETS87	US Government Resource
http://www.kb.cert.org/vuls/id/MIMG-7ETS87	US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2008:118
http://www.mandriva.com/security/advisories?name=MDVSA-2008:118
http://www.ocert.org/advisories/ocert-2008-006.html
http://www.ocert.org/advisories/ocert-2008-006.html
http://www.openwall.com/lists/oss-security/2008/06/09/1
http://www.openwall.com/lists/oss-security/2008/06/09/1
http://www.redhat.com/support/errata/RHSA-2008-0529.html
http://www.redhat.com/support/errata/RHSA-2008-0529.html
http://www.securityfocus.com/archive/1/493218/100/0/threaded
http://www.securityfocus.com/archive/1/493218/100/0/threaded
http://www.securityfocus.com/archive/1/497962/100/0/threaded
http://www.securityfocus.com/archive/1/497962/100/0/threaded
http://www.securityfocus.com/bid/29623	Exploit Patch
http://www.securityfocus.com/bid/29623	Exploit Patch
http://www.securitytracker.com/id?1020218
http://www.securitytracker.com/id?1020218
http://www.ubuntu.com/usn/usn-685-1
http://www.ubuntu.com/usn/usn-685-1
http://www.us-cert.gov/cas/techalerts/TA08-162A.html	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA08-162A.html	US Government Resource
http://www.vmware.com/security/advisories/VMSA-2008-0013.html
http://www.vmware.com/security/advisories/VMSA-2008-0013.html
http://www.vmware.com/security/advisories/VMSA-2008-0017.html
http://www.vmware.com/security/advisories/VMSA-2008-0017.html
http://www.vupen.com/english/advisories/2008/1787/references
http://www.vupen.com/english/advisories/2008/1787/references
http://www.vupen.com/english/advisories/2008/1788/references
http://www.vupen.com/english/advisories/2008/1788/references
http://www.vupen.com/english/advisories/2008/1797/references
http://www.vupen.com/english/advisories/2008/1797/references
http://www.vupen.com/english/advisories/2008/1800/references
http://www.vupen.com/english/advisories/2008/1800/references
http://www.vupen.com/english/advisories/2008/1801/references
http://www.vupen.com/english/advisories/2008/1801/references
http://www.vupen.com/english/advisories/2008/1836/references
http://www.vupen.com/english/advisories/2008/1836/references
http://www.vupen.com/english/advisories/2008/1981/references
http://www.vupen.com/english/advisories/2008/1981/references
http://www.vupen.com/english/advisories/2008/2361
http://www.vupen.com/english/advisories/2008/2361
http://www.vupen.com/english/advisories/2008/2971
http://www.vupen.com/english/advisories/2008/2971
http://www.vupen.com/english/advisories/2009/1612
http://www.vupen.com/english/advisories/2009/1612
https://bugzilla.redhat.com/show_bug.cgi?id=447974
https://bugzilla.redhat.com/show_bug.cgi?id=447974
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414
https://www.exploit-db.com/exploits/5790
https://www.exploit-db.com/exploits/5790
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-287	Improper Authentication	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

6 change records found show changes

CVE Modified by CVE 11/20/2024 7:43:19 PM

Action	Type	New Value
Added	Reference	http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
Added	Reference	http://lists.ingate.com/pipermail/productinfo/2008/000021.html
Added	Reference	http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html
Added	Reference	http://marc.info/?l=bugtraq&m=127730470825399&w=2
Added	Reference	http://marc.info/?l=bugtraq&m=127730470825399&w=2
Added	Reference	http://rhn.redhat.com/errata/RHSA-2008-0528.html
Added	Reference	http://secunia.com/advisories/30574
Added	Reference	http://secunia.com/advisories/30596
Added	Reference	http://secunia.com/advisories/30612
Added	Reference	http://secunia.com/advisories/30615
Added	Reference	http://secunia.com/advisories/30626
Added	Reference	http://secunia.com/advisories/30647
Added	Reference	http://secunia.com/advisories/30648
Added	Reference	http://secunia.com/advisories/30665
Added	Reference	http://secunia.com/advisories/30802
Added	Reference	http://secunia.com/advisories/31334
Added	Reference	http://secunia.com/advisories/31351
Added	Reference	http://secunia.com/advisories/31467
Added	Reference	http://secunia.com/advisories/31568
Added	Reference	http://secunia.com/advisories/32664
Added	Reference	http://secunia.com/advisories/33003
Added	Reference	http://secunia.com/advisories/35463
Added	Reference	http://security.gentoo.org/glsa/glsa-200808-02.xml
Added	Reference	http://securityreason.com/securityalert/3933
Added	Reference	http://sourceforge.net/forum/forum.php?forum_id=833770
Added	Reference	http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380
Added	Reference	http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1
Added	Reference	http://support.apple.com/kb/HT2163
Added	Reference	http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm
Added	Reference	http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml
Added	Reference	http://www.debian.org/security/2008/dsa-1663
Added	Reference	http://www.kb.cert.org/vuls/id/878044
Added	Reference	http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q
Added	Reference	http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z
Added	Reference	http://www.kb.cert.org/vuls/id/MIMG-7ETS87
Added	Reference	http://www.mandriva.com/security/advisories?name=MDVSA-2008:118
Added	Reference	http://www.ocert.org/advisories/ocert-2008-006.html
Added	Reference	http://www.openwall.com/lists/oss-security/2008/06/09/1
Added	Reference	http://www.redhat.com/support/errata/RHSA-2008-0529.html
Added	Reference	http://www.securityfocus.com/archive/1/493218/100/0/threaded
Added	Reference	http://www.securityfocus.com/archive/1/497962/100/0/threaded
Added	Reference	http://www.securityfocus.com/bid/29623
Added	Reference	http://www.securitytracker.com/id?1020218
Added	Reference	http://www.ubuntu.com/usn/usn-685-1
Added	Reference	http://www.us-cert.gov/cas/techalerts/TA08-162A.html
Added	Reference	http://www.vmware.com/security/advisories/VMSA-2008-0013.html
Added	Reference	http://www.vmware.com/security/advisories/VMSA-2008-0017.html
Added	Reference	http://www.vupen.com/english/advisories/2008/1787/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1788/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1797/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1800/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1801/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1836/references
Added	Reference	http://www.vupen.com/english/advisories/2008/1981/references
Added	Reference	http://www.vupen.com/english/advisories/2008/2361
Added	Reference	http://www.vupen.com/english/advisories/2008/2971
Added	Reference	http://www.vupen.com/english/advisories/2009/1612
Added	Reference	https://bugzilla.redhat.com/show_bug.cgi?id=447974
Added	Reference	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820
Added	Reference	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785
Added	Reference	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414
Added	Reference	https://www.exploit-db.com/exploits/5790
Added	Reference	https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html
Added	Reference	https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html
Added	Reference	https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html

CVE Modified by CERT/CC 9/28/2017 9:30:31 PM

Action	Type	Old Value	New Value
Added	Reference		https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820 [No Types Assigned]
Added	Reference		https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785 [No Types Assigned]
Added	Reference		https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414 [No Types Assigned]
Added	Reference		https://www.exploit-db.com/exploits/5790 [No Types Assigned]
Removed	Reference	http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10820 [No Types Assigned]
Removed	Reference	http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5785 [No Types Assigned]
Removed	Reference	http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6414 [No Types Assigned]
Removed	Reference	http://www.milw0rm.com/exploits/5790 [Exploit]

Quick Info

CVE Dictionary Entry:
CVE-2008-0960
NVD Published Date:
06/10/2008
NVD Last Modified:
11/20/2024
Source:
CERT/CC

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2008-0960 Detail

Current Description

Analysis Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by CVE 11/20/2024 7:43:19 PM

CVE Modified by CERT/CC 5/13/2024 9:51:02 PM

CPE Deprecation Remap by NIST 10/30/2018 12:25:36 PM

CVE Modified by CERT/CC 10/15/2018 6:03:44 PM

CVE Modified by CERT/CC 9/28/2017 9:30:31 PM

Initial CVE Analysis 6/10/2008 3:45:00 PM

Quick Info