buglwIP - A Lightweight TCP/IP stack - Bugs: bug #54886, Issue with SNMP app which can lead...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54886: Issue with SNMP app which can lead to controller restart

Submitter:  Ognjen Bjelica <ognjenbjelica>
Submitted:  Tue 23 Oct 2018 01:25:17 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Jump to the original submission

Tue 23 Oct 2018 01:26:50 PM UTC, comment #6: 

Fixed in 2e7b4573a573803e3865085461b424443bb411f9

Thanks for reporting!

Dirk Ziegelmeier <dziegel>
Group administrator
Tue 23 Oct 2018 01:25:17 PM UTC, comment #5: 

This item has been reassigned from the project lwIP - A Lightweight TCP/IP stack patch tracker to your tracker.

The original report is still available at patch #9707

Following are the information included in the original report:

[field #0]                  Item ID: 9707

[field #1]                 Group ID: 3159

[field #2]              Open/Closed: Open

[field #3]                 Severity: 3 - Normal

[field #4]                  Privacy: Private

[field #8]                         : Unknown patch Field Display Type

[field #9]                 Category: apps

[field #10]             Submitted by: ognjenbjelica

[field #11]              Assigned to: None

[field #12]             Submitted on: Tue 23 Oct 2018 12:14:25 PM UTC

[field #13]                  Summary: Issue with SNMP app which can lead to controller restart

[field #14]      Original Submission: Thank you for making and maintaing LWIP stack for free. While we were using SNMP app, one of the requirements was to support sending traps in v1 and v2c. Since original app wasn’t providing these functionalities, we have implemented them as a patch. Now SNMP app has support for sending traps, notifications and informs. For informs we have added callback, so main app can have feedback.
While testing we were testing the SNMP app, we have found one critical bug which caused controller to go to restart state. When you define MIB tree, with some read-only or some write-only nodes, or you just don’t need testing function and leave one of them to be nullptr. In that case, with current implementation of SNMP app, you have create a security vulnerability. Because, if user tries to call SET on read-only or GET on write-only node, SNMP app will go through MIB tree and find corresponding function pointer (in this case nullptr) and than it would call it - which would result in controller restart.
Please feel free to contact me for any additional info.

Best Regards,
Ognjen Bjelica

[field #16]               Item Group: None

[field #17]                   Status: None

[field #18]        Component Version: None

[field #19]         Operating System: None

[field #20]          Reproducibility: None

[field #21]               Size (loc): None

[field #22]            Fixed Release: None

[field #23]          Planned Release: None

[field #24]                   Effort: 0.00

[field #28]                 Priority: 5 - Normal

[field #31]         Percent Complete: 0%

[field #33]                  Release: None

[field #58]     Custom Select Box #1: None

[field #59]     Custom Select Box #2: None

[field #60]     Custom Select Box #3: None

[field #61]     Custom Select Box #4: None

[field #62]     Custom Select Box #5: None

[field #63]     Custom Select Box #6: None

[field #64]     Custom Select Box #7: None

[field #65]     Custom Select Box #8: None

[field #66]     Custom Select Box #9: None

[field #67]    Custom Select Box #10: None


Dirk Ziegelmeier <dziegel>
Group administrator
Tue 23 Oct 2018 01:12:46 PM UTC, comment #4: 

As you have suggested I have created a new task. Thanks

Ognjen Bjelica <ognjenbjelica>
Tue 23 Oct 2018 01:08:30 PM UTC, comment #3: 

Traps/informs work will be moved to task

Dirk Ziegelmeier <dziegel>
Group administrator
Tue 23 Oct 2018 01:04:25 PM UTC, comment #2: 

Thanks for quick reply. I have splitted original patch file into 2 files. Would you like me to close this thread and create 2 separate ones or is this enough?

Ognjen Bjelica <ognjenbjelica>
Tue 23 Oct 2018 12:20:43 PM UTC, comment #1: 

Could you please make 2 patches where one fixes the security issue you talked about (will be fixed in 2.1.x branch) and the other adds new functionality (will be pushed to master branch resulting in 2.2.0)?

Simon Goldschmidt <goldsimon>
Group administrator
Tue 23 Oct 2018 01:25:17 PM UTC, original submission:  

Thank you for making and maintaing LWIP stack for free. While we were using SNMP app, one of the requirements was to support sending traps in v1 and v2c. Since original app wasn’t providing these functionalities, we have implemented them as a patch. Now SNMP app has support for sending traps, notifications and informs. For informs we have added callback, so main app can have feedback.
While testing we were testing the SNMP app, we have found one critical bug which caused controller to go to restart state. When you define MIB tree, with some read-only or some write-only nodes, or you just don’t need testing function and leave one of them to be nullptr. In that case, with current implementation of SNMP app, you have create a security vulnerability. Because, if user tries to call SET on read-only or GET on write-only node, SNMP app will go through MIB tree and find corresponding function pointer (in this case nullptr) and than it would call it - which would result in controller restart.
Please feel free to contact me for any additional info.

Best Regards,
Ognjen Bjelica

Ognjen Bjelica <ognjenbjelica>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #45267:  0001-Fixes-for-SNMP-app-by-Softhouse-ComAp - Security-fix.patch added by ognjenbjelica (2KiB - application/octet-stream - Thanks for quick reply. I have splitted original patch into 2.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by ognjenbjelica (Submitted the item)
  • -email is unavailable- added by ognjenbjelica
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-10-23 dziegel StatusNone Fixed
        Open/ClosedOpen Closed
    2018-10-23 dziegel Attached File#45266 Removed
    2018-10-23 dziegel Attached File#45268 Removed
    2018-10-23 dziegel Reassign itemlwIP - A Lightweight TCP/IP stack, patch #9707 lwIP - A Lightweight TCP/IP stack, bug #54886

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code