[prev in list] [next in list] [prev in thread] [next in thread] 

List:       net-snmp-bugs
Subject:    [ net-snmp-Bugs-3010546 ] Auth broken in snmp v3 if username contains
From:       "SourceForge.net" <noreply () sourceforge ! net>
Date:       2010-07-08 18:36:17
Message-ID: E1OWvxJ-0000eU-Nr () sfs-web-6 ! v29 ! ch3 ! sourceforge ! com
[Download RAW message or body]

Bugs item #3010546, was opened at 2010-06-02 11:39
Message generated for change (Comment added) made by davidchill
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=3010546&group_id=12694

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: security
Group: linux
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: David Hill (davidchill)
Assigned to: Nobody/Anonymous (nobody)
Summary: Auth broken in snmp v3 if username contains a "-" using SHA

Initial Comment:
Auth is broken in snmp v3 if username contains a "-" using SHA/AES but not if using \
MD5/DES.

We're using net-snmp-5.3.2.2-7.el5_4.2 on Centos 5.4.

The application doesn't crash, it only fails to authenticate using SHA/AES if the \
username contains a "-" ...



----------------------------------------------------------------------

Comment By: David Hill (davidchill)
Date: 2010-07-08 14:36

Message:
Well we fixed the problem by remove the "-" in the username...  
I would need to find a 5.3.3 RPM and recreate everything.  Maybe you can
close this bug if you can't reproduce it.   Maybe it's a weird snmpd.conf
configuration file that causes this bug to appear.

----------------------------------------------------------------------

Comment By: Dave Shield (dts12)
Date: 2010-07-08 08:13

Message:
Can you try with release 5.3.3 (or higher), and confirm whether the problem
still occurs?
I've just tried to reproduce this with the current code.  Using both 5.3.x
and 5.5.x lines,
SNMPv3 requests work quite happily with usernames containing '-'   (for
both MD5/DES and SHA/AES).



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=3010546&group_id=12694

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Net-snmp-bugs mailing list
Net-snmp-bugs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/net-snmp-bugs


[prev in list] [next in list] [prev in thread] [next in thread]