[nsp-sec] What is this SNMP vulnerability day? asn1 vulnerability in linux kernel 2.4

[Smith, Donald]

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1673

Overview
The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and
2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules;
and (b) the gxsnmp package; does not properly validate length values
during decoding of ASN.1 BER data, which allows remote attackers to
cause a denial of service (crash) or execute arbitrary code via (1) a
length greater than the working buffer, which can lead to an unspecified
overflow; (2) an oid length of zero, which can lead to an off-by-one
error; or (3) an indefinite length for a primitive encoding.

Security through obscurity WORKS against some worms and ssh attacks:)
Donald.Smith at qwest.com giac 


This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.