Re: a question with "SECURITY RELEASE: Multple Net-SNMP VersionsReleased"

2008/6/16 SUN LI-WEN-VQB783 <VQB783@motorola.com>:
> we couldn't find the patch for the net-snmp-5.2.1.

No - we only provided a fixed version for the latest release
in each line. For the 5.2.x line, this is 5.2.4.1


> And we downloaded the net-snmp.patch from the web
> http://sourceforge.net/, the contents of it is as follows:
>
> --- net-snmp-5.4.1/snmplib/scapi.c 2006-09-15 05:47:01.000000000 -0700
> +++ net-snmp-5.4.1.1/snmplib/scapi.c 2008-05-13 17:43:17.000000000 -0700
> @@ -563,6 +563,10 @@
> }
>
>
> + if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
> + QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
> + }
> +
> /*

Yes - that's the fix for this problem.


> This is a patch for 5.4.1, could we just add
>
> if (maclen != USM_MD5_AND_SHA_AUTH_LEN) {
> QUITFUN(SNMPERR_GENERR, sc_check_keyed_hash_quit);
> }
>
> to the v5.2.1/snmplib/scapi.c to accomplish the security bug.

Yes.
That's exactly what you need to do.

Dave

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php
_______________________________________________
Net-snmp-users mailing list
Net-snmp-users@lists.sourceforge.net
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/...net-snmp-users