SNMP support for Perl 5 - Notes on Security

On February 12, 2002, the Computer Emergency Response Team issued CERT™ Advisory CA-2002-03 Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP). The OUSPG at the University of Oulu in Finland had written an SNMPv1 test suite that uncovered difficulties in numerous SNMP implementations with respect to improperly encoded SNMP PDUs (Protocol Data Units). Possible effects of these vulnerabilities included program crashes as well as remote exploitabilities. 

Why SNMP_Session.pm/BER.pm Users Shouldn't Be Too Concerned

My SNMP support for Perl 5 is written entirely in Perl. When it decodes BER-encoded SNMP PDUs, it parses them from left to right and splits them into sub-items as it goes, usually using substr() or unpack().


2002/04/07 21:43:11 Simon Leinen <simon.leinen@switch.ch>