Openwave Systems Inc. Information for VU#854306

Openwave Systems Inc. ackowledges the potential of SNMP vulnerabilities
described in [VU#107186 and VU#854306].  Openwave embeds SNMP
in their messaging products for the purpose of internal measuring and
monitoring of the messaging system.  The vulnerabilities listed above can
cause denial of service of the SNMP service when specific malformed packets
are delivered, but since most customers do not allow SNMP traffic
through their firewall, and only utilize SNMP inside their firewall for
the purpose of internal monitoring, they should be immune
to the SNMP vulnerabilities listed above.  Even if SNMP traffic
is allowed through the firewall, or no firewall is employed, the SNMP
vulnerabilities above can at most cause denial of service of the SNMP
services and cannot cause either unprivleged access or denial of service
of the messaging products themselves.

A patch will be made available by Openwave to address the SNMP
vulnerabilities.  Customers can determine if a patch is needed
by inspecting their version of snmpdm via the following command:
 
% ./snmpdm -d

Versions which are 15.3.1.7 or greater have no vulnerability.  Customers
who require upgrades to their version of snmpdm should contact their Openwave
Technical Support representative for availability of a patch on their
specific product line.

Some customers additionally use a toolkit delivered by Openwave
called the "TACPAC".  This toolkit contains a utility called
snmptrapd which is also vulnerable to the SNMP issues mentioned
above.  Customers who use this tool are encouraged to
contact their Openwave Technical Support representative to obtain
a new version of the tool which removes the vulnerabilities.