buglwIP - A Lightweight TCP/IP stack - Bugs: bug #60714, SNMPv3: Buffer overflow in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #60714: SNMPv3: Buffer overflow in usmusertable_get_next_instance

Submitted by:  Tim Schendekehl <timschendekehl>
Submitted on:  Tue 01 Jun 2021 09:20:42 AM UTC  
Category:  apps Severity:  3 - Normal
Item Group:  Crash Error Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Tue 01 Jun 2021 09:20:42 AM UTC, original submission:  

Function usmusertable_get_next_instance in src/apps/snmp/snmp_snmpv2_usm.c constructs an OID, which contains the engine ID and the username. Since engine ID and username can be 32 bytes long and the lengths are also stored in the OID, the resulting OID can be up to 1 + 32 + 1 + 32 = 66 elements long. The generated OID is stored in the local buffer test_oid, which has only 32 elements. For long engine ID or username this can result in a buffer overflow.

Tim Schendekehl <timschendekehl>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by timschendekehl (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    No changes have been made to this item

    Back to the top

    Powered by Savane 3.7