CERT home
vulnerabilities & fixesevaluations & practicesresearch & analysistraining & education
homesearchFAQsite indexcontact
Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information
 

 View Notes By
Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric

Vulnerability Note VU#107186

Multiple vulnerabilities in SNMPv1 trap handling

Overview

Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below.

I. Description

The Oulu University Secure Programming Group (OUSPG) has reported numerous vulnerabilities in multiple vendor SNMPv1 implementations. By applying the PROTOS c06-SNMPv1 test suite to a variety of popular SNMPv1-enabled products, the OUSPG revealed a number of vulnerabilities across a wide range of products. This vulnerability note focuses on vulnerabilities occurring in code responsible for SNMPv1 trap handling.

SNMPv1 supports five different types of messages: GetRequest, SetRequest, GetNextRequest, GetResponse, and Trap. A single SNMP message is referred to as a Protocol Data Unit (PDU). These messages are described using Abstract Syntax Notation One (ASN.1) and translated into binary format using Basic Encoding Rules (BER). SNMP trap messages are sent from agents to managers. Trap messages are unsolicited (the manager does not issue a request message) and may indicate a warning or error condition or otherwise notify the manager about the agent's state. SNMP managers should reliably decode trap messages and process the resulting application data. OUSPG performed two sets of tests of SNMP trap message handling: one test focused on ASN.1 decoding, the second looked for exceptions in the processing of the decoded data.

The results yielded multiple vulnerabilities in both the ASN.1 decoding and the subsequent processing of SNMP trap messages by many different SNMP managers. Vulnerabilities include denial-of-service conditions, format string vulnerabilities, and buffer overflows. Some vulnerabilities do not require the request message to use the correct SNMP community string.

Additional Background Information on the OUSPG

OUSPG is a academic research group located at Oulu University in Finland. The purpose of this research group is to test software for vulnerabilities.

History has shown that the techniques used by the OUSPG have discovered a large number of previously undetected problems in the products and protocols they have tested. In 2001, the OUSPG produced a comprehensive test suite for evaluating implementations of the Lightweight Directory Access Protocol (LDAP). This test suite was developed with the strategy of stressing protocol implementations in unsupported and unexpected ways, and it was very effective in uncovering a wide variety of vulnerabilities across several products. This approach can reveal vulnerabilities that would not manifest themselves under normal operating conditions.

After completing its work on LDAP, OUSPG moved its focus to SNMPv1. As with LDAP, they designed a custom test suite, began testing a selection of products, and found a number of vulnerabilities. Because OUSPG's work on LDAP was similar in procedure to its current work on SNMP, you may wish to review the LDAP Test Suite and CERT Advisory CA-2001-18, which outlined results of application of the test suite.

In order to test the security of protocols like SNMPv1, the PROTOS project presents a server with a wide variety of sample packets containing unexpected values or illegally formatted data. As a member of the PROTOS project consortium, the OUSPG used the PROTOS c06-snmpv1 test suite to study several implementations of the SNMPv1 protocol. Results of the test suites run against SNMP indicate that there are many different vulnerabilities on many different implementations of SNMP.

Background Information on the Simple Network Management Protocol

The Simple Network Management Protocol (SNMP) is the most popular protocol in use to manage networked devices. SNMP was designed in the late 80's to facilitate the exchange of management information between networked devices, operating at the application layer of the ISO/OSI model. The SNMP protocol enables network and system administrators to remotely monitor and configure devices on the network (devices such as switches and routers). Software and firmware products designed for networks often make use of the SNMP protocol. SNMP runs on a multitude of devices and operating systems, including, but not limited to,


    Core Network Devices (Routers, Switches, Hubs, Bridges, and Wireless Network Access Points)
    Consumer Broadband Network Devices (Cable Modems and DSL Modems)
    Consumer Electronic Devices (Cameras and Image Scanners)
    Networked Office Equipment (Printers, Copiers, and FAX Machines)
    Network and Systems Management/Diagnostic Frameworks (Network Sniffers and Network Analyzers)
    Networked Medical Equipment (Imaging Units and Oscilloscopes)
    Manufacturing and Processing Equipment

The SNMPv1 protocol is formally defined in RFC1157. Quoting from that RFC:
    Implicit in the SNMP architectural model is a collection of network management stations and network elements. Network management stations execute management applications which monitor and control network elements. Network elements are devices such as hosts, gateways, terminal servers, and the like, which have management agents responsible for performing the network management functions requested by the network management stations. The Simple Network Management Protocol (SNMP) is used to communicate management information between the network management stations and the agents in the network elements.

Additionally, SNMP is discussed in a number of other RFC documents:

    RFC 3000 Internet Official Protocol Standards
    RFC 1212 Concise MIB Definitions
    RFC 1213 Management Information Base for Network Management of TCP/IP-based Internets: MIB-II
    RFC 1215 A Convention for Defining Traps for use with the SNMP
    RFC 1270 SNMP Communications Services
    RFC 2570 Introduction to Version 3 of the Internet-standard Network Management Framework
    RFC 2571 An Architecture for Describing SNMP Management Frameworks
    RFC 2572 Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)
    RFC 2573 SNMP Applications
    RFC 2574 User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)
    RFC 2575 View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)
    RFC 2576 Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework

II. Impact

These vulnerabilities may cause denial-of-service conditions, service interruptions, and in some cases may allow an attacker to gain access to the affected device. Specific impacts will vary from product to product.

III. Solution

Note that many of the mitigation steps recommended below may have significant impact on your everyday network operations and/or network architecture. Care should therefore be taken to ensure that any changes made based on the following recommendations will not negatively impact your ongoing network operations capability.


Contact your vendor for patches.
Please see the Solution section of CA-2002-03 for additional countermeasures.

Systems Affected

VendorStatusDate Updated
2WireUnknown10-Jan-2002
3ComVulnerable20-Feb-2002
Adaptec Inc.Unknown10-Jan-2002
ADCUnknown10-Jan-2002
ADTRAN Inc.Vulnerable21-Feb-2002
ADVA AG Optical Networking Not Vulnerable21-Aug-2002
AdvantechUnknown14-Jan-2002
AdventNetVulnerable7-Nov-2007
Agere SystemsUnknown14-Jan-2002
Agilent TechnologiesUnknown9-Jan-2002
AIRCONNECTUnknown14-Jan-2002
AlcatelUnknown20-Feb-2002
Alidian NetworksUnknown14-Jan-2002
Allied Telesyn InternationalNot Vulnerable18-Aug-2003
Alpha TechnologiesUnknown14-Jan-2002
Alvarion Ltd.Not Vulnerable18-Mar-2002
AMDUnknown11-Jan-2002
American Power Conversion CorporationVulnerable9-Apr-2002
Amnis SystemsUnknown14-Jan-2002
Analog Devices Inc.Unknown11-Jan-2002
Ando CorporationUnknown14-Jan-2002
Apple Computer, Inc.Not Vulnerable12-Mar-2002
AprismaVulnerable6-Mar-2002
ARINC IncorporatedUnknown14-Jan-2002
Asante Technologies Inc.Not Vulnerable5-Mar-2002
Askey Computer CorporationUnknown14-Jan-2002
AstraconNot Vulnerable15-Aug-2002
Atheros CommunicationsUnknown10-Jan-2002
Atos OriginUnknown9-Jan-2002
AvayaVulnerable7-Mar-2002
AVET Information and Network SecurityNot Vulnerable5-Apr-2002
Avici Systems Inc.Not Vulnerable21-Feb-2002
AwareUnknown21-Jan-2002
Aztech Systems LtdUnknown10-Jan-2002
BEA Systems Inc.Vulnerable19-Jun-2002
Berkeley Software Design, Inc.Unknown19-Dec-2001
BinTec Communications AGNot Vulnerable11-Jun-2002
BMC SoftwareVulnerable11-Jun-2002
Broadcom CorporationUnknown11-Jan-2002
Brocade Communications Systems Inc.Unknown14-Jan-2002
C-SPEC CorporationUnknown14-Jan-2002
CacheFlow Inc.Vulnerable5-Feb-2002
CalSoftUnknown14-Jan-2002
Cambridge Broadband LimitedNot Vulnerable25-Feb-2002
Canoga Perkins CorporationNot Vulnerable12-Apr-2002
Canon U.S.A. Inc.Unknown14-Jan-2002
Carrier AccessVulnerable7-Mar-2002
Cayman Systems Inc.Unknown11-Jan-2002
Charles Industries LtdUnknown14-Jan-2002
Check PointNot Vulnerable21-Feb-2002
CipherTrust INCNot Vulnerable28-Feb-2002
Cisco Systems, Inc.Vulnerable13-Feb-2002
Clarent CorporationUnknown21-Jan-2002
CNTVulnerable8-Apr-2002
Compaq Computer CorporationVulnerable10-Apr-2002
Computer AssociatesVulnerable12-Feb-2002
COMTEK Services IncVulnerable22-Mar-2002
ComtestUnknown14-Jan-2002
Comtrend CorporationUnknown10-Jan-2002
Concord CommunicationsVulnerable19-Mar-2002
Conexant Systems Inc.Unknown14-Jan-2002
Controlware GmbHNot Vulnerable20-Mar-2002
Convedia CorporationUnknown10-Jan-2002
Convergent NetworksUnknown14-Jan-2002
Copper Mountain Networks Inc.Unknown10-Jan-2002
CoresmaUnknown10-Jan-2002
Corsaire LimitedNot Vulnerable25-Feb-2002
CoSine CommunicationsUnknown10-Jan-2002
CovalentNot Vulnerable12-Feb-2002
Cray Inc.Unknown5-Apr-2002
Critical PathUnknown14-Jan-2002
Crossroads Systems IncUnknown10-Jan-2002
CSCare Inc.Vulnerable6-Mar-2002
Cyclades CorporationUnknown18-Jan-2002
D-Link SystemsNot Vulnerable28-Feb-2002
Dart CommunicationsVulnerable27-Feb-2002
Dartware LLCNot Vulnerable5-Mar-2002
Data ConnectionUnknown10-Jan-2002
Data GeneralUnknown19-Dec-2001
DATAXUnknown14-Jan-2002
DellVulnerable19-Apr-2002
Digital NetworksVulnerable25-Jul-2002
DMH SoftwareNot Vulnerable28-Apr-2002
DNE Technologies Inc.Unknown14-Jan-2002
DynarcUnknown14-Jan-2002
e-Security Inc.Vulnerable19-Mar-2002
Efficient Networks IncNot Vulnerable4-Mar-2002
EMC CorporationUnknown14-Jan-2002
EmulexUnknown14-Jan-2002
Enterasys NetworksUnknown13-Feb-2002
Entrada NetworksVulnerable22-Apr-2002
Equinox SystemsVulnerable19-Mar-2002
EricssonUnknown9-Jan-2002
Evidian Inc.Unknown5-Apr-2002
Extreme NetworksUnknown10-Jan-2002
F5 Networks, Inc.Vulnerable15-Mar-2002
Fluke CorporationVulnerable26-Apr-2002
Foundry Networks Inc.Not Vulnerable18-Feb-2002
FreeBSD, Inc.Vulnerable13-Feb-2002
FujitsuUnknown19-Dec-2001
Future Communications SoftwareNot Vulnerable5-Nov-2002
GE Industrial SystemsUnknown15-Jan-2002
General DataCommVulnerable21-Feb-2002
Guardian Digital Inc. Not Vulnerable3-Jan-2002
Halcyon Monitoring SolutionsUnknown11-Jan-2002
Haliplex Pty LtdUnknown14-Jan-2002
Hewlett-Packard CompanyVulnerable1-Apr-2002
Hirschmann Electronics GmbH & CoVulnerable8-Feb-2002
HitachiUnknown14-Jan-2002
HitachiVulnerable24-May-2005
HoneywellUnknown23-Jan-2002
Huawei TechnologiesUnknown14-Jan-2002
IBM-zSeriesUnknown7-Jan-2002
IBM CorporationVulnerable26-Feb-2002
IMC NetworksUnknown14-Jan-2002
Industrial Networking SolutionsUnknown10-Jan-2002
InfoVistaVulnerable22-Mar-2002
Inktomi CorporationVulnerable21-Feb-2002
Innerdive Solutions LLCVulnerable11-Feb-2002
INRANGE TechnologiesUnknown26-Feb-2002
IntelUnknown4-Jan-2002
Interniche TechnologiesNot Vulnerable22-Sep-2003
Interphase CorporationUnknown5-Feb-2002
Intrusion Inc.Unknown15-Jan-2002
Invensys plcUnknown10-Jan-2002
IP InfusionUnknown10-Jan-2002
IPlanetVulnerable28-Aug-2002
Ipswitch Inc.Vulnerable6-Mar-2002
Ishoni NetworksUnknown14-Jan-2002
ITouch CommunicationsVulnerable6-Mar-2002
IxiaUnknown10-Jan-2002
Juniper Networks, Inc.Vulnerable12-Feb-2002
KarlNet Inc.Vulnerable25-Mar-2002
Kentrox LLCUnknown25-Mar-2002
Komatsu Ltd.Unknown14-Jan-2002
LachmanUnknown7-Jan-2002
LantronixVulnerable30-Jan-2002
Larscom IncorporatedVulnerable6-Mar-2002
Legato Systems Inc.Unknown11-Jan-2002
Lexmark International Inc.Not Vulnerable20-Feb-2002
LiebertUnknown11-Jan-2002
LinksysUnknown9-Jan-2002
LOGEC Systems Inc.Not Vulnerable12-Feb-2002
LogiSoft ARUnknown10-Jan-2002
Lotus SoftwareVulnerable11-Feb-2002
Lucent TechnologiesVulnerable21-Feb-2002
Mandriva, Inc.Vulnerable5-Mar-2002
MarconiVulnerable14-Jan-2002
MarvellUnknown14-Jan-2002
Memotec CommunicationsUnknown11-Jan-2002
Mercury Interactive CorporationVulnerable23-Sep-2002
MetaSwitchUnknown14-Jan-2002
Metrobility Optical SystemsVulnerable14-May-2003
MG-SOFT CorporationVulnerable14-Feb-2002
MicromuseVulnerable15-Feb-2002
Microsoft CorporationVulnerable13-Feb-2002
Mistral Software Inc.Unknown14-Jan-2002
Modlink NetworksNot Vulnerable25-Mar-2002
Monfox LLCVulnerable4-Mar-2002
MotorolaUnknown11-Jan-2002
MultinetVulnerable19-Dec-2001
MuonicsNot Vulnerable11-Jun-2003
M/A-COMUnknown14-Jan-2002
Nbase-XyplexVulnerable6-Mar-2002
nCipher Corp.Not Vulnerable1-Mar-2002
NCRUnknown14-Jan-2002
NEC CorporationVulnerable28-Mar-2002
NET-SNMPVulnerable16-Feb-2002
NETAPHOR SOFTWARE INCUnknown12-Feb-2002
NetBSDUnknown19-Dec-2001
NETGEARUnknown10-Jan-2002
NetopiaUnknown7-Jan-2002
NetPlane SystemsUnknown10-Jan-2002
Netscape Communications CorporationVulnerable12-Feb-2002
NetScout Systems Inc.Vulnerable26-Mar-2002
NetScreenNot Vulnerable21-Feb-2002
NetSilicon Inc.Vulnerable6-Mar-2002
Network ApplianceVulnerable7-Mar-2002
Network AssociatesNot Vulnerable25-Jan-2002
Network Computing TechnologiesUnknown10-Jan-2002
NETWORK HARMONi Inc.Vulnerable20-Mar-2002
net.comVulnerable7-Mar-2002
NexGen Software Unknown14-Jan-2002
Nishan SystemsUnknown10-Jan-2002
NokiaNot Vulnerable3-Jan-2002
Nortel Networks, Inc.Vulnerable22-Feb-2002
Novell, Inc.Vulnerable4-Mar-2002
NuDesign Team Inc.Vulnerable27-Jul-2004
OLE Communications Inc.Unknown14-Jan-2002
OmnitronixUnknown25-Jan-2002
OpenBSDNot Vulnerable8-Feb-2002
Openwave Systems Inc.Vulnerable21-Feb-2002
Optical AccessVulnerable26-Feb-2002
Oracle CorporationVulnerable7-Mar-2002
Outback Resource Group Inc.Vulnerable24-Apr-2002
PaionUnknown14-Jan-2002
Paradyne Networks Inc.Unknown5-Mar-2002
Perle Systems LtdVulnerable26-Feb-2002
PlurisUnknown10-Jan-2002
PolycomUnknown14-Jan-2002
PortmastersUnknown29-Jan-2002
Powerware CorporationVulnerable7-Mar-2002
Precise Software Technologies Inc.Unknown11-Jan-2002
Prism CommunicationsUnknown10-Jan-2002
PulsecomUnknown14-Jan-2002
QLogicUnknown10-Jan-2002
QUALCOMMNot Vulnerable19-Dec-2001
Quallaby CorporationNot Vulnerable27-Feb-2002
Quick Eagle NetworksNot Vulnerable13-Mar-2002
QuintomUnknown14-Jan-2002
RAD Data CommunicationsNot Vulnerable26-Mar-2002
RADVISIONUnknown14-Jan-2002
RadwareVulnerable22-Mar-2002
Red Hat, Inc.Vulnerable8-Jan-2002
Redback Networks Inc.Vulnerable26-Feb-2002
RittalUnknown21-Jan-2002
Riverstone NetworksVulnerable21-Feb-2002
Samsung ElectronicsUnknown10-Jan-2002
SANavigator Inc.Unknown10-Jan-2002
SaskenUnknown14-Jan-2002
SatelcomUnknown21-Jan-2002
Scientific-AtlantaUnknown14-Jan-2002
SecureWorksUnknown4-Mar-2002
Sensorsoft CorporationUnknown21-Jan-2002
Sequent Computer Systems, Inc.Unknown19-Dec-2001
SGIUnknown3-Jan-2002
Sierra WirelessNot Vulnerable14-Feb-2002
Sinetica Corporation LimitedNot Vulnerable15-Oct-2002
SMC NetworksUnknown11-Jan-2002
Snap ServerUnknown4-Jan-2002
Sniffer TechnologiesVulnerable7-Mar-2002
SNMP Frameworks Inc.Unknown10-Jan-2002
SNMP ResearchVulnerable12-Feb-2002
Software Technologies GroupUnknown15-Jan-2002
SolarWinds.Net Inc.Not Vulnerable5-Mar-2002
SonicWALL INC.Vulnerable25-Feb-2002
Sonus NetworksVulnerable26-Feb-2002
Sony CorporationUnknown19-Dec-2001
Spider SoftwareUnknown21-Feb-2002
Spirent CommunicationsUnknown10-Jan-2002
Standard Networks Inc.Not Vulnerable21-Feb-2002
StonesoftVulnerable6-Mar-2002
StorageSoft Inc.Unknown14-Jan-2002
Stratus TechnologiesUnknown14-Jan-2002
Sun Microsystems, Inc.Vulnerable27-Oct-2003
Symantec CorporationVulnerable1-Apr-2003
Sync Research ProductsUnknown10-Jan-2002
Tality CorporationUnknown18-Jan-2002
TANDBERGNot Vulnerable13-Feb-2002
Tavve Software CompanyNot Vulnerable28-Mar-2002
Telogy NetworksUnknown10-Jan-2002
Telsey TelecommunicationsUnknown14-Jan-2002
TerayonUnknown14-Jan-2002
Texas Instruments IncorporatedUnknown14-Jan-2002
The SCO Group (SCO Unix)Vulnerable13-Sep-2002
Tivoli SystemsVulnerable3-Apr-2002
TMP Consultoria S/CNot Vulnerable21-Feb-2002
TollBridge TechnologiesUnknown14-Jan-2002
Tollgrade Communications Inc.Unknown21-Jan-2002
Top Layer NetworksNot Vulnerable1-Apr-2002
Toshiba International CorporationVulnerable16-Apr-2002
Trend MicroNot Vulnerable5-Mar-2002
TRENDware InternationalUnknown14-Jan-2002
Tripp LiteUnknown15-Jan-2002
Tut Systems Inc.Unknown10-Jan-2002
Unisphere NetworksVulnerable22-Mar-2002
Uptime DevicesNot Vulnerable6-Mar-2002
VerilinkUnknown26-Mar-2002
Veritas SOFTWAREVulnerable24-Apr-2002
Vertical Networks Inc.Vulnerable4-Aug-2003
Vina TechnologiesVulnerable19-Apr-2002
VIVE Synergies Inc. Unknown14-Jan-2002
VixelUnknown10-Jan-2002
Vpacket CommunicationsUnknown14-Jan-2002
Wailan Communications Inc.Unknown10-Jan-2002
Westell Technologies IncUnknown21-Jan-2002
Western Telematic Inc.Unknown14-Jan-2002
Wind River Systems, Inc.Vulnerable11-Mar-2002
World Wide PacketsVulnerable27-Feb-2002
Xerox CorporationVulnerable1-Apr-2003
XspeedUnknown10-Jan-2002
YipesUnknown10-Jan-2002
Zman Tikshuv Ltd.Unknown21-Jan-2002
ZyXELUnknown14-Jan-2002

References

http://www.cert.org/tech_tips/snmp_faq.html
http://www.kb.cert.org/vuls/id/854306
http://www.ee.oulu.fi/research/ouspg/protos/
http://www.cert.org/tech_tips/denial_of_service.html
http://www.ietf.org/rfc/rfc3000.txt
http://www.ietf.org/rfc/rfc1212.txt
http://www.ietf.org/rfc/rfc1213.txt
http://www.ietf.org/rfc/rfc1215.txt
http://www.ietf.org/rfc/rfc1270.txt
http://www.ietf.org/rfc/rfc2570.txt
http://www.ietf.org/rfc/rfc2571.txt
http://www.ietf.org/rfc/rfc2572.txt
http://www.ietf.org/rfc/rfc2573.txt
http://www.ietf.org/rfc/rfc2574.txt
http://www.ietf.org/rfc/rfc2575.txt
http://www.ietf.org/rfc/rfc2576.txt
http://www.securityfocus.com/bid/4088
http://online.securityfocus.com/bid/4132
http://online.securityfocus.com/bid/4732

Credit

The CERT Coordination Center thanks the Oulu University Secure Programming Group for reporting these vulnerabilities to us, for providing detailed technical analyses, and for assisting us in preparing this advisory. We also thank the many vendors who provided feedback regarding their respective vulnerabilities.

This document was written by Ian A. Finlay.

Other Information

Date Public02/12/2002
Date First Published02/12/2002 01:54:31 PM
Date Last Updated11/07/2007
CERT AdvisoryCA-2002-03
CVE NameCAN-2002-0012
Metric69.25
Document Revision48

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

Copyright 2002 Carnegie Mellon University