Subject: Re: [USR-TC] CERT Advisory CA-2002-03: SNMPv1 Vulnerabilities

From: [email-masked]
Date: Wed, 13 Feb 2002 20:07:30 +0000

New NMC code has been posted on http://totalservice.commworks.com . The
following NMC codes provide protection from possible Denial Of Service
(DoS) attacks via SNMP.  These concerns were raised by a CERT advisory
issued today (see http://www.kb.cert.org/vuls/id/854306).

To find the NMC code do the following:
1)Go to the Software Library Link located under the Software section of the
totalservice web page
2) Choose the Enhanced Data Services (RAS) icon
3) Then Click on the drop down arrow and choose Network Management Cards
4) The NMC code is posted as follows:

HM080296:  HiPerNMC v8.2.96.  This code is based on version 8.2.97 and
includes fixes to prevent NMC reboots that might be caused by certain SNMP
requests.

HH080396:  NMC-333 v8.3.96. This code is based on version 8.3.97 and
includes fixes to prevent NMC reboots that might be caused by certain SNMP
requests.

The NMC code is also posted under the TCS 4.3 software suite located under
the same drop down arrow as the Network Management Cards.

Please note: This issue has been fixed on the TCS 4.5 Beta load.

---

From: Florian Lohoff <[email-masked]>
Date: Thu, 14 Feb 2002 14:00:19 +0000

Hi,

> issued today (see http://www.kb.cert.org/vuls/id/854306).

It still is vulnerarable as we found out. Just get the testsuite from

http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/

And you will find your NMC in a state where it answers pings
but does not answer to snmp queries.

Access lists work but are more a joke as with UDP you can easily spoof
the source and destination address. 

HARCs 5.0.77 5.1.70 5.3.2 are stable and dont care about broken packets.

Flo
PS: Just because you're paranoid doesn't mean they AREN'T after you.
-- 
[email-masked]                                         +49-5246-80-1185
Nine nineth on september the 9th              Welcome to the new billenium