IZ51440: UA CRASHES WHEN SNMP TRAP:VARBIND HAS VERY LARGE STRING VALUE

APAR status

• Closed as program error.

Error description

• Env: ITM 6.21
  ITM Universal Agent 6.21
  TEMS/TEP on AIX 5.3
  
  Problem Description:
  
      The customer is experiencing a problem where the TEP is
  showing the
  agent as going offline after a certain amount of time. The
  customer
  initially stated 30 mins, but in another test the agent was up
  for quite
  sometime before the it crashed.
  
  
  
  
  
  
  
  At the time of the failure, the UA receives a large amount of
  hexadecimal data in OpenViewData VarBind element. An example is:
  
  "KUMS_ConvertVarBindListToString") VarBind string 3297
  {openViewSourceId=14}{openViewSourceName=amdnetapp1}{openViewDat
  a=457665
  6E7 ...
  
  The inordinate amount of data coming back for the
  OpenViewData VarBind element is leading to a memory overwrite
   in UA code and thus the resulting crash occurs.
  

Local fix

Problem summary

• On rare occasion some SNMP traps contain a member in their
  VarBind list where said member has a lengthy data value, larger
  than UA was designed for, and as a result a memory overwrite
  occurs in UA code; thus the resulting crash. UA was designed to
  expect the maximum length of an Object value to be 512 bytes.
  

Problem conclusion

• UA logic for composing the VarBind data buffer has been changed
  to check size of next VarBind object value before appending it
  to VarBind data buffer.  If the available space in data buffer
  is insufficient, VarBind data buffer size is increased and the
  next VarBind object value is then appended.
  
  *** IMPORTANT NOTE ***  There is a limit to maximum length of a
  data row in UA ( 5000 bytes ) and for a data attribute ( 4000
  bytes ), so it remains possible for the resulting value of
  Value_List (VarBind) in Portal Client display to be truncated.
  This APAR fix prevents the crashing of UA; it does not and it
  can not address the aforementioned size limitations.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
      | interim fix | 6.2.1-TIV-ITM-IF0004
  

Temporary fix

• Turning off SNMP TRAP monitoring, though a significant measure,
  will avoid crashing UA.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  UNIVERSAL AGENT

• Fixed component ID

  5724K1000

Applicable component levels

• R621 PSY

     UP