Subject: [USR-TC] CERT Advisory CA-2002-03: SNMPv1 Vulnerabilities

From: Carl Litt <[email-masked]>
Date: Wed, 13 Feb 2002 19:29:03 +0000

CERT has just released an advisory concerning vulnerabilities in SNMPv1
which exist in many vendor implementations, including 3Com.

3Com has acknowledged that several switches are are vulnerable, but there
has been no news about the Total Control series.  Does anyone know if the
SNMP implementation on the ARC/NMC cards is safe?

For reference:

http://www.kb.cert.org/vuls/id/854306
http://www.kb.cert.org/vuls/id/107186 

Carl Litt
Network Administrator
Execulink Internet

---

From: Steve Johnson <[email-masked]>
Date: Wed, 13 Feb 2002 19:39:07 +0000

Yeah if anyone knows please post is on this list.. I sure hope they are not 
vulnerable...

-Steve

On Wednesday 13 February 2002 11:29 am, Carl Litt wrote:
> _______________________________________________
> USR-TC mailing list
> [email-masked]
> http://mailman.xmission.com/cgi-bin/mailman/listinfo/usr-tc

---

From: Jeff Mcadams <[email-masked]>
Date: Wed, 13 Feb 2002 19:52:27 +0000

Also sprach Carl Litt

>3Com has acknowledged that several switches are are vulnerable, but
>there has been no news about the Total Control series.  Does anyone
>know if the SNMP implementation on the ARC/NMC cards is safe?

>http://www.kb.cert.org/vuls/id/107186 

Given the number of SNMP vulnerabilities that I've found in the past on
the Arcs and NMCs (2 or 3, and that was when I wasn't even looking very
hard), I'd be surprised if they *weren't* vulnerable.  :/
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456