Xiang Li

I am only interested in finding a way to exploit this bug to cause DOS on the snmpd server side, not snmpget client. I already tried to SET, in addition to GET/NEXT using malformed variable bindings, although what I did is for SNMPv1 and SNMP V2c SET. I would think V3 code uses the same code for parsing variable bindings but I am not sure (I may come back to check this later). For SNMP engineID discovery, I believe NET-SNMP agent will send back a report with the usmStatsUnknownEngineIDs counter in...

Thanks Bill for the pointer. Unfortunately I looked these two cap files but it appears that none of SNMP requests contained there can actually trigger a crash. it is likely that the original person who reported this was working on a customized version of net-snmp. For example, a snmp-get without any variable bindings got a report from the agnet with 9 variable bindings (packet_eth0_0a3_2.pcap). I don't think the original net-snmp does that. I quickly glanced the related source code, it appears that...

Thanks Bill for the pointer. Unfortunately I looked these two cap files but it appears that none of SNMP requests contained there can actually trigger a crash. it is likely the original user is using a customized version of net-snmp. For example, a snmp-get without any variable bindings got a report from the agnet with 9 variable bindings (packet_eth0_0a3_2.pcap). I don't think the original net-snmp does that. A quickly glanced the related source, it appears that although the code before patching...

Hi I use SilverCreek and I was asked to create a test to verify this has been fixed. I did read the related code and see the issue should have been fixed. But I could not find a way to verify the fix. I used NET-SNMP 5.4 and 5.7.3 to test. I could not cause to agent under test to crash (denial of service) by creating a tampered request that does what you suggested in your document (quoted below): Whenever snmpparsevarop() fails, the last variable will remain within the list, partially initialized....