snmpd in mater agentx mode crashed when subagent closed
TCP connection.
A TCP conection close routine is malfunction.
( at 5446 line in snmp_api.c )
It raise SIGSEGV.
5367 if (transport->flags &
NETSNMP_TRANSPORT_FLAG_STREAM) {
...
5389 newbuf =
5390 (u_char *) realloc(isp->packet,
5391
isp->packet_len + rxbuf_len);
...
5398 isp->packet = newbuf;
5399 isp->packet_size =
isp->packet_len + rxbuf_len;
5400 rxbuf = isp->packet +
isp->packet_len;
}
...
5432 if (length <= 0 && transport->flags &
NETSNMP_TRANSPORT_FLAG_STREAM) {
...
5446 SNMP_FREE(rxbuf);
...
}
5446 line must free not rxbuf but isp->packet.
< SNMP_FREE(rxbuf);
------------------
> SNMP_FREE(isp->packet);
Nobody/Anonymous ( nobody ) - 2005-05-23 12:05
5
Closed
Fixed
Robert Story
None
None
Public
|
Date: 2007-07-16 01:58 Logged In: NO |
|
Date: 2007-04-11 09:28
|
|
Date: 2007-04-11 09:28
|
|
Date: 2005-06-09 21:46 Logged In: YES |
| Field | Old Value | Date | By |
|---|---|---|---|
| summary | snmpd crash on tcp disconnect | 2007-04-11 09:36 | tanders |
| summary | snmpd crash on tcp disconnect [CVE-2005-4837] | 2007-04-11 09:28 | dts12 |
| summary | snmpd crash on tcp disconnect | 2007-04-11 09:28 | tanders |
| summary | [v5.2.1] snmpd crashed at master agentx | 2005-06-09 21:46 | rstory |
| status_id | Open | 2005-06-09 21:46 | rstory |
| close_date | - | 2005-06-09 21:46 | rstory |
| resolution_id | None | 2005-06-09 21:46 | rstory |
| assigned_to | nobody | 2005-06-09 21:46 | rstory |
Copyright © 2010 Geeknet, Inc. All rights reserved. Terms of Use