Feeds

Serious network security holes surface

Black day for BOFHs

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

A slew of security vulnerabilities in implementations of SNMP (Simple Network Management Protocol) may allow unauthorised privileged access, denial-of-service attacks, or cause unstable behaviour, security clearing house CERT has warned.

SNMP is a widely-deployed protocol commonly used to monitor and manage network devices. The scary thing about the alert is that more 47 vendors are listed, most of whom report that their kit is affected by the problem to a greater or lesser extent.

Cisco, Computer Associates, Hewlett-Packard, Juniper, Lucent, Marconi, and Microsoft, to name just a few, have issued patches to correct various SNMP implementation flaws. Others, like Nortel, are still evaluating the issue, though some report that their products are not affected.

For system admins, evaluating what needs to be done is going to be a nightmare. This is a black day for BOFHs and the question has to be asked why such a potentially serious set of problems which, if CERT is to be believed, could threaten the stability of the Internet, haven't come to light earlier.

The vulnerabilities were discovered by the Secure Programming Group of Finland's Oulu University, and involve the way which SNMPv1 agents and managers handle requests and trap messages, according to CERT.

Filtering SNMP services and other measures have been suggested as a workaround, and a careful review of the patches available has been urged.

To that we'd add the advice, don't panic. We're at the early stage of what may be a serious infrastructure problem, or an alarmist alert, and it's too early to say which yet -- but not to soon to bring it to people's attention. ®

Related Stories

The SNMP fiasco: steps you need to take
CERT alert - Multiple Vulnerabilities in Many Implementations of SNMP

Internet Security Threat Report 2014

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.