CVE-2008-0960
Description
SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
SNMPv3 - HMAC Validation error Remote Authentication Bypass
#############################################################################
# #
# snmpv3_exp.sh exploit the vulnerability described in CVE-2008-0960, the #
# HMAC check problem (on multiple vendor) #
# #
# Copyright (c) 2008 @ Mediaservice.net Srl. All rights reserved #
# Wrote by Maurizio Agazzini <inode[at]mediaservice.net> #
# http://lab.mediaservice.net/ #
# #
#############################################################################
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5790.tgz (2008-snmpv3_exp.tgz)
# milw0rm.com [2008-06-12]OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 5.4.1~dfsg-8.1 |
| sid | Fixed | 5.4.1~dfsg-8.1 |
| forky | Fixed | 5.4.1~dfsg-8.1 |
| bullseye | Fixed | 5.4.1~dfsg-8.1 |
| bookworm | Fixed | 5.4.1~dfsg-8.1 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.