lwIP - A Lightweight TCP/IP stack - Bugs: bug #60714, SNMPv3: Buffer overflow in...
You are not allowed to post comments on this tracker with your current authentication level.
bug #60714: SNMPv3: Buffer overflow in usmusertable_get_next_instance
Submitter: | Tim Schendekehl <timschendekehl> | ||
Submitted: | Tue 01 Jun 2021 09:20:42 AM UTC | ||
Category: | apps | Severity: | 3 - Normal |
Item Group: | Crash Error | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open | Planned Release: | None |
lwIP version: | git head |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
No changes have been made to this item
Powered by Savane 3.13-f8d8.
Corresponding source code
Function usmusertable_get_next_instance in src/apps/snmp/snmp_snmpv2_usm.c constructs an OID, which contains the engine ID and the username. Since engine ID and username can be 32 bytes long and the lengths are also stored in the OID, the resulting OID can be up to 1 + 32 + 1 + 32 = 66 elements long. The generated OID is stored in the local buffer test_oid, which has only 32 elements. For long engine ID or username this can result in a buffer overflow.