CVE-2008-0960
CriticalPublic exploitSNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2;…
Published Jun 10, 2008 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2008-0960, DSA-1663-1, DTSA-137-1
Key Facts
Patch immediately- CVE-2008-0960 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Session And Resource Control (Juniper), Src Pe (Juniper), net-snmp (debian) and 5 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 69% probability of exploitation in the next 30 days.
- Fixed versions are available, including net-snmp 0:5.0.9-2.30E.24, net-snmp 0:5.1.2-11.el4_6.11.3, net-snmp 1:5.3.1-24.el5_2.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
69%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2008-0960 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.
Affected Products
24 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Session And Resource ControlJuniper | 1.0, 2.0 | n/a |
| Src PeJuniper | 1.0, 2.0 | n/a |
| net-snmpdebian | See advisory | 5.4.1~dfsg-8.1 |
| net-snmp-develoracle | See advisory | 1:5.3.1-24.el5_2.1 |
| net-snmp-libsoracle | See advisory | 1:5.3.1-24.el5_2.1 |
Patched Releases
net-snmp
0:5.0.9-2.30E.24, 0:5.1.2-11.el4_6.11.3, 1:5.3.1-24.el5_2.1, 5.2.3-7etch4, 5.4.1~dfsg-7.1+lenny1, 5.4.1~dfsg-8.1
net-snmp-devel
1:5.3.1-24.el5_2.1
net-snmp-libs
1:5.3.1-24.el5_2.1
net-snmp-perl
1:5.3.1-24.el5_2.1
net-snmp-utils
1:5.3.1-24.el5_2.1
ucd-snmp
0:4.2.5-8.AS21.7
Timeline
Publicly disclosed
Jun 10, 2008
Last updated
Aug 4, 2026
Weakness Type
- CWE-287 Improper Authentication
References
- advisoryRHSA-2008:0528
- advisoryRHSA-2008:0529
- advisory30574
- advisory30596
- advisory30615
FAQ
Common Questions.
SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multipl…
Affected: Session And Resource Control (Juniper) versions 1.0, 2.0; Src Pe (Juniper) versions 1.0, 2.0; net-snmp (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including net-snmp 0:5.0.9-2.30E.24, net-snmp 0:5.1.2-11.el4_6.11.3, net-snmp 1:5.3.1-24.el5_2.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2008-0960 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo