I just updated the bug report with some new info:
It looks like it is the function netsnmp_scalar_group_helper_handler in agent/helpers/scalar_group.c. Rev 1.4 if the file contains this change:
-use local var for rootoid machinations, instead of reginfo rootoid realloc of extra suboids doesn't survive registration, when subtree_split calls netsnmp_subtree_deepcopy())
Replacing that function with the previous version seems to
fix the problem. I'm not sure what in the new version would cause it to not work with MS04-011..
It looks like netsnmp_scalar_group_helper_handler is continuously called.
Alex
Alex Burger wrote:
I tried some binaries created by Mike which were compiled on win2k advanced server sp4 without the latest Microsoft patches and while they worked fine for Mike, I had the same bad results.
It always stops in IP-MIB so that is where I will start looking.
Thanks
Alex
Alex Burger wrote:
Hi Mike.
[EMAIL PROTECTED] wrote:
Transparency is a virtue here...
It seems that update is for Terminal Server, which I am not in the habit of loading onto my machines.
Regardless, I think it strange that 5.2 has the problem, while 5.1.2 does not...
The patch covers multiple vulnerabilities. I will dig into it more. All I have really done so far is make sure that I can re-produce it on any W2k computer.
Alex
From: Alex Burger <[EMAIL PROTECTED]>
Date: 2004/09/26 Sun PM 11:07:35 EDT
To: Andy Smith <[EMAIL PROTECTED]>, "Michael J. Slifcak" <[EMAIL PROTECTED]>
Subject: Re: Win32: 5.2pre1 snmpwalk causes snmpd to take 99% CPU
I just updated the bug report:
https://sourceforge.net/tracker/index.php?func=detail&aid=1030156&group_id=12694&atid=112694
It looks like it's KB835732 (MS04-011). Can you both let me know if you have that patch installed on your machines? Here's the bulletin:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
It's for NT 4.0, 2000, XP and 2003.
All the machines I was testing on had this patch.
Alex
------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Net-snmp-coders mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
