Cisco warns of SNMP vulnerability
- By Joab Jackson
- Jun 13, 2008
Researchers have found a pair of vulnerabilities of Version 3 of the Simple Network Management Protocol that could allow attackers to gather system data or even change configurations of network equipment, according to an >advisory
issued by Cisco Systems.
SNMP is a standardized protocol used for remotely monitoring and managing network devices. This security hole can be exploited by sending malformed SNMPv3 messages. Machines running SNMPv3 will accept incomplete authentication packets, allowing a malicious user with a valid username for that machine to guess at authentication code.
Multiple Cisco products are vulnerable to this exploitation, though SNMP is disabled by default in Cisco gear. Equipment running the Cisco IOS, CatOS and the IOS-XR operating systems may be vulnerable. Administrations should log in to such equipment to find out which version of SNMP the equipment runs. Only version 3 of SNMP is affected. Cisco's advisory offers links to patches as well as describes how administrators can change their equipment's setting to guard against exploitation.
In addition to certain Cisco products, network equipment by other vendors using SNMPv3 may also affected, including gear sold by 3Com, Apple Computer, Avaya, CA, EMC, Hewlett-Packard, Juniper Networks, McAfee, Network Appliance, Red Hat, Sun Microsystems and others, according to the United States Computer Emergency Response Team (US-CERT
This vulnerability has been assigned Vulnerability Note VU#878044 by US-CERT and identifier CVE-2008-0960 in the Common Vulnerabilities and Exposures database.
Joab Jackson is the senior technology editor for Government Computer News.