Symantec Corporation Information for VU#107186
Multiple vulnerabilities in SNMPv1 trap handling
Symantec verified that the snmptrap.exe on the Intruder Alert (ITA) 3.6 agent, if configured to accept SNMP traps from Symantec NetProwler, is susceptible to a communications Denial of Service when the PROTOS test suite is directed against it. The communicator service will be halted, the halt will be logged and the service requires a restart to reinitiate communications.
This should be a very low risk issue to Symantec ITA customers. The snmptrap.exe module is loaded on an ITA agent machine. Depending on customer configuration if the snmptrap module is loaded on an ITA agent located on the internal network of the company then the collector is only vulnerable to an internal attack as long as the firewall rule set blocks snmptrap communications through the firewall.
The functionality of the snmptrap.exe allows smooth integrated alert management of both NIDS and HIDS from a single administrator console. Halting the communicator module disrupts the integrated communications only. Both the NetProwler and the ITA IDS systems continue to fuction normally but will require monitoring from separate consoles until the communicator service is restarted.
Symantec takes any product issue such as this very seriously. We have developed a patch for Symantec ITA 3.6 that addresses this problem. The patch is available to Symantec ITA 3.6 customers from the Symantec customer ITA ftp download site as ITA3_6Patch1/061302/. There is a patch for both domestic and international releases.
Please contact firstname.lastname@example.org for questions on product upgrades.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.