Re: a question with "SECURITY RELEASE: Multple Net-SNMP Versions Released"

2008/6/16 SUN LI-WEN-VQB783 <[email protected]>:
> we couldn't find the patch for the net-snmp-5.2.1.

No - we only provided a fixed version for the latest release
in each line.   For the 5.2.x line, this is 5.2.4.1


>    And we downloaded the net-snmp.patch from the web
> http://sourceforge.net/, the contents of  it is as follows:
>
> --- net-snmp-5.4.1/snmplib/scapi.c 2006-09-15 05:47:01.000000000 -0700
> +++ net-snmp-5.4.1.1/snmplib/scapi.c 2008-05-13 17:43:17.000000000 -0700
> @@ -563,6 +563,10 @@
>      }
>
>
> +    if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
> +        QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
> +    }
> +
>      /*

Yes - that's the fix for this problem.


> This is a patch for 5.4.1, could we just add
>
>  if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
>        QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
>    }
>
> to the v5.2.1/snmplib/scapi.c to accomplish the security bug.

Yes.
That's exactly what you need to do.

Dave

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users