InfoVista Information for VU#107186
Multiple vulnerabilities in SNMPv1 trap handling
In reference to CERT Advisory CA-2002-03, Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP), InfoVista has reviewed and addressed this advisory that reports how vulnerabilities may allow unauthorized privileged access, denial of service attacks, or unstable behavior.
InfoVista has assessed the InfoVista product portfolio and investigated the impact of this advisory. Tests have been performed against the PROTOS c06-snmpv1 test suite and as a result, InfoVista products fixes are being created, if needed, which will resolve any related issues. Upgrades to our product line that address these issues will be released in the near future.
A status of each InfoVista product is as follows:
The InfoVista Server is not affected by trap & agent-side vulnerabilities. The InfoVista Server performs numerous consistency checks on SNMP packets, thus being immune to most attacks. Further evaluation is underway to assess any vulnerability and, if exposures as reported in the advisory are found, fixes will be provided.
Vista Plug-in for NetFlow
The Vista Plug-in for NetFlow version 3.0 includes Emanate 126.96.36.199, which does not address these vulnerabilities. The latest version of Emanate 188.8.131.52, which accounts for these vulnerabilities, will be included in the next version of the Vista Plug-in for NetFlow. A product release schedule will be communicated soon.
Vista Plug-in Family
Full testing of our agents for the vulnerabilities identified in CERT Advisory CA-2002-03, VU#854306 and VU#107186 have been completed. A hotfix for the Vista Plug-in Family that corrects these vulnerabilities is scheduled for release at the end of March.
VistaNotifier is not affected by agent-side vulnerabilities. VistaNotifier does consistency checks for traps, while expecting these traps to be in a specific format (from the InfoVista server), thus being immune to most attacks. Further evaluation is underway to assess any vulnerability and, if exposures as reported in the advisory are found, fixes will be provided.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.