Forgot to provide poc in last email


  We found one bug in snmp by fuzzing. Here is the vulnerability info
and poc. Please assist us to get the cve number, it is very important
to us.

  Discover: Yingchao Yu, Shibin Zhao, Chiheng Wang

The vulnerability is located in the snmp_add_var() function in
net-snmp/snmplib/snmp_api.c. When Agentxtrap parses the variable after the
`b` character in the parameter, it will apply for a buf with a size of 256,
and then put the variable string into the `vp`.

  [image: image.png]

  Then convert the string of the variable into an integer value in
sequence according to the delimiter, and divide it by 8 as the `ix`
value.

  [image: image.png]

  When `ix` is greater than `buf_len`, the snmp_relloc() function
(defined in net-snmp/snmplib/tools.c) will be called, and only the
original 256 size buf will be expanded to 256*2, and through this
judgment condition.

  [image: image.png]

  But since the value of `ltmp` can be arbitrarily parameterized, it
will cause `ix` to be arbitrarily large. Therefore, if `ix` is large
enough, it is greater than 256*2 of buf at this time! Then when
`buf[ix]` is taken out later, a heap overflow will occur.

    poc:

Hi,
 Could you provide what input you are fuzzing here that caused both
problems for agentxtrap?  It looks like possibly you're looking at the
OID/TYPE/VALUE on the command line which to me is not a security issue
while some sort of buffer overflow in the response packet parsing is a very
different matter.

Also what are these crash files? I don't recognise the format and they're
only 20 bytes so can't be doing too much.

$ hd -C ~/Downloads/crash-c256ceeeca53f55adbf2c9913f3f0640fb2599a7
00000000  00 40 20 32 00 20 30 2e  22 20 49 20 31 30 64 2e  |.@ 2. 0." I
10d.|
00000000  00 40 20 32 00 20 30 2e  22 20 49 20 31 30 64 2e  |.@ 2. 0." I
10d.|
00000010  20 49 00 2a                                       | I.*|
00000010  20 49 00 2a                                       | I.*|
00000014