Time Table

mini-snmpd is a small SNMP agent for routers and other embedded systems. OpenWrt packages it for devices where net-snmp is too large. Our team found an information leak in it that had been there since 2015.

An OID can carry redundant padding that changes its encoded length but not its value. Two parts of the agent disagree about which length to use, and the difference goes out on the wire. The agent rejects a wrong community string, but still returns a response meant for another client, and with it that client’s real community string.

The mechanism is simple enough. The harder question is why no tool caught it for eleven years, and why fixing exactly what the tools do report leaves the leak in place.

Speakers:
Aaron Cho Offensive Security Researcher, SSD Secure Disclosure