Feeds

Most SNMP vulns quietly lurking

All quiet - not all clear

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

It's been over a week since CERT released a seemingly endless list of devices and software products containing SNMP vulnerabilities discovered by Finnish University of Oulu researchers, and to date very little bad has happened, no doubt to the disappointment of most news agencies. As the story drops off the media radar screen, it's important to keep in mind that threats to your system can't be measured by the amount of mainstream press coverage they receive.

The PROTOS auditing suite developed by the Finnish researchers has been available for download at least since the original CERT advisory, and possibly longer. This means that while things are quiet, there's no question that industrious members of the blackhat development community are using it to advantage.

For example, the PROTOS tool doesn't include a buffer overflow exploit, but researchers working with SANS were able to come up with a working buffer overflow to get root access to several versions of Linux in about two hours, Counterpane Security Architect Tina Bird remarked receltly.

"It's safe to say that they're not the only people who were able to do that," she added wryly.

Linux and Solaris are definitely vulnerable to root access exploits, primarily via buffer overflows. But this won't always be easy to detect.

"Most messages in SNMP manager logs indicate test cases that don't jam the system up, but don't fit what the listener is expecting. It [merely] creates an error message that it can't understand the data," Bird says.

"An attacker who actually knows which test cases are causing the problem is going to write an exploit that only uses those. He's not going to take the system down."

For this reason there may be serious SNMP attacks that go unnoticed for some time, until everyone gets accustomed to looking for the signs.

"One of the problems with system monitoring is that it's generally much easier to see attacks that fail than it is to see attacks that succeed," Bird notes.

Another useful tip from Counterpane: if SNMP is disabled on Solaris and the system is subsequently patched, it's possible that the patch will re-enable it, so this has to be checked.

There's another free SNMP scanner available, called SNScan from Foundstone. It will take lists of IPs, but apparently not machine names. It also runs only on Windows, like SNMPing from SANS. Both tools will scan a wide range of equipment, however.

Again, the best single source of information and links to vendor bulletins is the CERT advisory, which has been updated over forty times since it was created last week. ®

Related stories

SNMP exploit causes printers to jam
Why your vendor has no SNMP fix
Scanning for SNMP vulnerabilities
The SNMP fiasco: steps you need to take
Serious network security holes surface

Providing a secure and efficient Helpdesk

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.