Description
Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | net-snmp | 5.4.1~dfsg-8 | — |
| Debian 13 | net-snmp | 5.4.1~dfsg-8 | — |
| Debian 12 | net-snmp | 5.4.1~dfsg-8 | — |
| Debian 5.0 | net-snmp | 5.4.1~dfsg-7+lenny1 | DTSA-134-1 |
| Debian 4.0 | net-snmp | 5.2.3-7etch4 | DSA-1663-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | net-snmp +4 | 1:5.3.1-24.el5_2.1 | RHSA-2008:0529 |
| RHEL 4 | net-snmp +4 | 5.1.2-11.el4_6.11.3 | RHSA-2008:0529 |
| RHEL 3 | net-snmp +4 | 5.0.9-2.30E.24 | RHSA-2008:0529 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.5 EUS | net-snmp +4 | 5.1.2-11.el4_6.11.3 | RHSA-2008:0529 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Net-SNMP 5.1.4/5.2.4/5.4.1 Perl Module - Buffer Overflow (PoC) EDB-7100 · dos · Nov 12, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0529 Red Hat Security Advisory: net-snmp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1663-1 net-snmp - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-134-1 net-snmp - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1020527 vdb-entry
- 30615 third-party-advisory
- 32664 third-party-advisory
- SUSE-SA:2008:039 vendor-advisory
- 30187 third-party-advisory
- 31351 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm
- http://sourceforge.net/tracker/index.php?func=detail&aid=1826174&group_id=12694&atid=112694
- FEDORA-2008-5215 vendor-advisory
- 31334 third-party-advisory
- ADV-2008-2141 vdb-entry
- 30647 third-party-advisory
- 29212 vdb-entry
- 33003 third-party-advisory
- ADV-2008-2361 vdb-entry
- 31568 third-party-advisory
- 31467 third-party-advisory
- 239785 vendor-advisory
- DSA-1663 vendor-advisory
- RHSA-2008:0529 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2008-0013.html
- 31155 third-party-advisory
- GLSA-200808-02 vendor-advisory
- netsnmp-snprintvalue-bo(42430) vdb-entry
- FEDORA-2008-5218 vendor-advisory
- FEDORA-2008-5224 vendor-advisory
- MDVSA-2008:118 vendor-advisory
- USN-685-1 vendor-advisory
- ADV-2008-1528 vdb-entry
- oval:org.mitre.oval:def:11261 vdb-entry signature