diff --git a/net-snmp-5.4.1-libwrap.patch b/net-snmp-5.4.1-libwrap.patch
new file mode 100644
index 0000000..a754571
--- /dev/null
+++ b/net-snmp-5.4.1-libwrap.patch
@@ -0,0 +1,25 @@
+CVE-2008-6123: snmp queries allowed from each remote host regardless of
+/etc/hosts.allow configuration
+
+Source: upstream, SVN rev. 17367
+
+diff -up net-snmp-5.4.2.1/snmplib/snmpUDPDomain.c.libwrap net-snmp-5.4.2.1/snmplib/snmpUDPDomain.c
+--- net-snmp-5.4.2.1/snmplib/snmpUDPDomain.c.libwrap	2007-10-11 22:46:30.000000000 +0200
++++ net-snmp-5.4.2.1/snmplib/snmpUDPDomain.c	2009-02-16 11:57:19.000000000 +0100
+@@ -104,12 +104,12 @@ netsnmp_udp_fmtaddr(netsnmp_transport *t
+ 	char tmp[64];
+         to = (struct sockaddr_in *) &(addr_pair->remote_addr);
+         if (to == NULL) {
+-            sprintf(tmp, "UDP: [%s]->unknown",
++            sprintf(tmp, "UDP: unknown->[%s]",
+                     inet_ntoa(addr_pair->local_addr));
+         } else {
+-            sprintf(tmp, "UDP: [%s]->", inet_ntoa(addr_pair->local_addr));
+-            sprintf(tmp + strlen(tmp), "[%s]:%hd",
+-                    inet_ntoa(to->sin_addr), ntohs(to->sin_port));
++            sprintf(tmp, "UDP: [%s]:%hu->",
++                inet_ntoa(to->sin_addr), ntohs(to->sin_port));
++            sprintf(tmp + strlen(tmp), "[%s]", inet_ntoa(addr_pair->local_addr));
+         }
+         return strdup(tmp);
+     }
diff --git a/net-snmp.spec b/net-snmp.spec
index dd2f351..7433681 100644
--- a/net-snmp.spec
+++ b/net-snmp.spec
@@ -8,7 +8,7 @@
 Summary: A collection of SNMP protocol tools and libraries
 Name: net-snmp
 Version: %{major_ver}
-Release: 7%{?dist}
+Release: 8%{?dist}
 Epoch: 1
 
 License: BSD and MIT
@@ -34,6 +34,7 @@ Patch9: net-snmp-5.4.1-strange_libpath.patch
 Patch10: net-snmp-5.4.1-shared-ip.patch
 Patch11: net-snmp-5.4.1-sensors3.patch
 Patch12: net-snmp-5.4.1-xen-crash.patch
+Patch13: net-snmp-5.4.1-libwrap.patch
 
 Requires(pre): chkconfig
 Requires(post): chkconfig
@@ -171,6 +172,7 @@ Net-SNMP toolkit library.
 #%patch10 -p1 -b .shared-ip
 %patch11 -p1 -b .sensors
 %patch12 -p1 -b .xen-crash
+%patch13 -p1 -b .libwrap
 
 # Do this patch with a perl hack...
 perl -pi -e "s|'\\\$install_libdir'|'%{_libdir}'|" ltmain.sh
@@ -419,6 +421,9 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_datadir}/snmp/mibs
 
 %changelog
+* Mon Feb 16 2009 Jan Safranek <jsafranek@redhat.com> 5.4.2.1-8
+- fix tcp_wrappers integration (CVE-2008-6123)
+
 * Fri Jan 30 2009 Karsten Hopp <karsten@redhat.com> 5.4.2.1-7
 - fix build on s390x which has no libsensors