Feeds

Most SNMP vulns quietly lurking

All quiet - not all clear

  • alert
  • submit to reddit

Intelligent flash storage arrays

It's been over a week since CERT released a seemingly endless list of devices and software products containing SNMP vulnerabilities discovered by Finnish University of Oulu researchers, and to date very little bad has happened, no doubt to the disappointment of most news agencies. As the story drops off the media radar screen, it's important to keep in mind that threats to your system can't be measured by the amount of mainstream press coverage they receive.

The PROTOS auditing suite developed by the Finnish researchers has been available for download at least since the original CERT advisory, and possibly longer. This means that while things are quiet, there's no question that industrious members of the blackhat development community are using it to advantage.

For example, the PROTOS tool doesn't include a buffer overflow exploit, but researchers working with SANS were able to come up with a working buffer overflow to get root access to several versions of Linux in about two hours, Counterpane Security Architect Tina Bird remarked receltly.

"It's safe to say that they're not the only people who were able to do that," she added wryly.

Linux and Solaris are definitely vulnerable to root access exploits, primarily via buffer overflows. But this won't always be easy to detect.

"Most messages in SNMP manager logs indicate test cases that don't jam the system up, but don't fit what the listener is expecting. It [merely] creates an error message that it can't understand the data," Bird says.

"An attacker who actually knows which test cases are causing the problem is going to write an exploit that only uses those. He's not going to take the system down."

For this reason there may be serious SNMP attacks that go unnoticed for some time, until everyone gets accustomed to looking for the signs.

"One of the problems with system monitoring is that it's generally much easier to see attacks that fail than it is to see attacks that succeed," Bird notes.

Another useful tip from Counterpane: if SNMP is disabled on Solaris and the system is subsequently patched, it's possible that the patch will re-enable it, so this has to be checked.

There's another free SNMP scanner available, called SNScan from Foundstone. It will take lists of IPs, but apparently not machine names. It also runs only on Windows, like SNMPing from SANS. Both tools will scan a wide range of equipment, however.

Again, the best single source of information and links to vendor bulletins is the CERT advisory, which has been updated over forty times since it was created last week. ®

Related stories

SNMP exploit causes printers to jam
Why your vendor has no SNMP fix
Scanning for SNMP vulnerabilities
The SNMP fiasco: steps you need to take
Serious network security holes surface

Providing a secure and efficient Helpdesk

More from The Register

next story
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
Torvalds CONFESSES: 'I'm pretty good at alienating devs'
Admits to 'a metric ****load' of mistakes during work with Linux collaborators
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.