Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Malformed packet leads to potential DoS vulnerability #381

Closed
ampliasec opened this issue Nov 11, 2021 · 2 comments · Fixed by #384
Closed

Malformed packet leads to potential DoS vulnerability #381

ampliasec opened this issue Nov 11, 2021 · 2 comments · Fixed by #384

Comments

@ampliasec
Copy link

A malformed SNMP packet can cause a panic that can lead to a DoS vulnerability in software using the gosnmp library.
The details are not included here because it would allow an attacker to exploit the issue.
Do you have an email or any other means to submit securely the detailed information and PoC to reproduce this issue (public key, etc.)?

Thank you!.
@SuperQ
Copy link
Contributor

SuperQ commented Nov 11, 2021

If you could hop on the Gophers Slack we could chat about it there.

@ampliasec
Copy link
Author

If you could hop on the Gophers Slack we could chat about it there.

Joined. Thanks!.

TimRots added a commit to TimRots/gosnmp that referenced this issue Nov 11, 2021
@TimRots
marshal.go: stricter cursor bounds checking in unmarshalPayload
cf63df0 
Stricter bounds checking for cursor in unmarshalPayload
to ensure it does not exceed ``len(packet)``, preventing
panic when receiving a malformed packet.

Special thanks to ampliasec_advisories for disclosing
this issue responsibly.

Fixes gosnmp#381

Signed-off-by: Tim Rots <tim.rots@protonmail.ch>
@TimRots TimRots mentioned this issue Nov 11, 2021
Merged
TimRots added a commit to TimRots/gosnmp that referenced this issue Nov 11, 2021
@TimRots
marshal.go: stricter cursor bounds checking in unmarshalPayload
e67f005 
Stricter bounds checking for cursor in unmarshalPayload
to ensure it does not exceed ``len(packet)``, preventing
panic when receiving a malformed packet.

Special thanks to ampliasec_advisories for disclosing
this issue responsibly.

Fixes gosnmp#381

Signed-off-by: Tim Rots <tim.rots@protonmail.ch>
TimRots added a commit to TimRots/gosnmp that referenced this issue Nov 11, 2021
@TimRots
marshal.go: stricter cursor bounds checking in unmarshalPayload
dff0efb 
Stricter bounds checking for cursor in unmarshalPayload
to ensure it does not exceed ``len(packet)``, preventing
panic when receiving a malformed packet.

Special thanks to Amplia Security for disclosing this issue responsibly.

Fixes gosnmp#381

Signed-off-by: Tim Rots <tim.rots@protonmail.ch>
TimRots added a commit that referenced this issue Nov 12, 2021
@TimRots
marshal.go: stricter cursor bounds checking in unmarshalPayload (#384)
03d9261 
Stricter bounds checking for cursor in unmarshalPayload,
to ensure it does not exceed or equals ``len(packet)``,
preventinga panic when receiving a malformed packet.

Special thanks to Amplia Security for disclosing this issue responsibly.

Fixes #381

Signed-off-by: Tim Rots <tim.rots@protonmail.ch>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

marshal.go: stricter cursor bounds checking in unmarshalPayload TimRots/gosnmp
2 participants
@SuperQ @ampliasec