Feeds

Most SNMP vulns quietly lurking

All quiet - not all clear

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

It's been over a week since CERT released a seemingly endless list of devices and software products containing SNMP vulnerabilities discovered by Finnish University of Oulu researchers, and to date very little bad has happened, no doubt to the disappointment of most news agencies. As the story drops off the media radar screen, it's important to keep in mind that threats to your system can't be measured by the amount of mainstream press coverage they receive.

The PROTOS auditing suite developed by the Finnish researchers has been available for download at least since the original CERT advisory, and possibly longer. This means that while things are quiet, there's no question that industrious members of the blackhat development community are using it to advantage.

For example, the PROTOS tool doesn't include a buffer overflow exploit, but researchers working with SANS were able to come up with a working buffer overflow to get root access to several versions of Linux in about two hours, Counterpane Security Architect Tina Bird remarked receltly.

"It's safe to say that they're not the only people who were able to do that," she added wryly.

Linux and Solaris are definitely vulnerable to root access exploits, primarily via buffer overflows. But this won't always be easy to detect.

"Most messages in SNMP manager logs indicate test cases that don't jam the system up, but don't fit what the listener is expecting. It [merely] creates an error message that it can't understand the data," Bird says.

"An attacker who actually knows which test cases are causing the problem is going to write an exploit that only uses those. He's not going to take the system down."

For this reason there may be serious SNMP attacks that go unnoticed for some time, until everyone gets accustomed to looking for the signs.

"One of the problems with system monitoring is that it's generally much easier to see attacks that fail than it is to see attacks that succeed," Bird notes.

Another useful tip from Counterpane: if SNMP is disabled on Solaris and the system is subsequently patched, it's possible that the patch will re-enable it, so this has to be checked.

There's another free SNMP scanner available, called SNScan from Foundstone. It will take lists of IPs, but apparently not machine names. It also runs only on Windows, like SNMPing from SANS. Both tools will scan a wide range of equipment, however.

Again, the best single source of information and links to vendor bulletins is the CERT advisory, which has been updated over forty times since it was created last week. ®

Related stories

SNMP exploit causes printers to jam
Why your vendor has no SNMP fix
Scanning for SNMP vulnerabilities
The SNMP fiasco: steps you need to take
Serious network security holes surface

Next gen security for virtualised datacentres

More from The Register

next story
Why has the web gone to hell? Market chaos and HUMAN NATURE
Tim Berners-Lee isn't happy, but we should be
Linux turns 23 and Linus Torvalds celebrates as only he can
No, not with swearing, but by controlling the release cycle
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Sin COS to tan Windows? Chinese operating system to debut in autumn – report
Development alliance working on desktop, mobe software
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
This is how I set about making a fortune with my own startup
Would you leave your well-paid job to chase your dream?
(Not so) Instagram now: Time-shifting Hyperlapse iPhone tool unleashed
Photos app now able to shoot fast-moving videos
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.