Openwave Systems Inc. Information for VU#107186

Multiple vulnerabilities in SNMPv1 trap handling



Vendor Statement

      Openwave Systems Inc. ackowledges the potential of SNMP vulnerabilities
      described in [VU#107186 and VU#854306].  Openwave embeds SNMP
      in their messaging products for the purpose of internal measuring and
      monitoring of the messaging system.  The vulnerabilities listed above can
      cause denial of service of the SNMP service when specific malformed packets
      are delivered, but since most customers do not allow SNMP traffic
      through their firewall, and only utilize SNMP inside their firewall for
      the purpose of internal monitoring, they should be immune
      to the SNMP vulnerabilities listed above.  Even if SNMP traffic
      is allowed through the firewall, or no firewall is employed, the SNMP
      vulnerabilities above can at most cause denial of service of the SNMP
      services and cannot cause either unprivleged access or denial of service
      of the messaging products themselves.

      A patch will be made available by Openwave to address the SNMP
      vulnerabilities.  Customers can determine if a patch is needed
      by inspecting their version of snmpdm via the following command:
      % ./snmpdm -d

      Versions which are or greater have no vulnerability.  Customers
      who require upgrades to their version of snmpdm should contact their Openwave
      Technical Support representative for availability of a patch on their
      specific product line.

      Some customers additionally use a toolkit delivered by Openwave
      called the "TACPAC".  This toolkit contains a utility called
      snmptrapd which is also vulnerable to the SNMP issues mentioned
      above.  Customers who use this tool are encouraged to
      contact their Openwave Technical Support representative to obtain
      a new version of the tool which removes the vulnerabilities.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References



The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.