a question with "SECURITY RELEASE: Multple Net-SNMP Versions Released"

  
Hi, 
   I am an employee in Motorola. And we are imformed of the " SECURITY
RELEASE: Multple Net-SNMP Versions Released", however, we couldn't find
the patch for the net-snmp-5.2.1. 
Becuase we are using the version of net-snmp-5.2.1, so we wonder if we
could get a patch for net-snmp-5.2.1, please. 
   And we downloaded the net-snmp.patch from the web 
http://sourceforge.net/ <http://sourceforge.net/> , the contents of  it
is as follows: 
 
--- net-snmp-5.4.1/snmplib/scapi.c 2006-09-15 05:47:01.000000000 -0700
+++ net-snmp-5.4.1.1/snmplib/scapi.c 2008-05-13 17:43:17.000000000 -0700
@@ -563,6 +563,10 @@
     }
 
 
+    if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
+        QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
+    }
+    
     /*
      * Generate a full hash of the message, then compare
      * the result with the given MAC which may shorter than
 
This is a patch for 5.4.1, could we just add 
 
 if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
       QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
   }
 
to the v5.2.1/snmplib/scapi.c to accomplish the security bug.
Thank you very much for you concern. 
 
 
Best Regards
Heidy Sun

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users