[NEWS] Bypassing Cisco SNMP Access Lists Using Spoofed SNMP Requests

From: SecuriTeam (support_at_securiteam.com)
Date: 08/08/05

  • Next message: SecuriTeam: "[NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buffer Overflow)" 
    To: list@securiteam.com
Date: 8 Aug 2005 17:32:14 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Bypassing Cisco SNMP Access Lists Using Spoofed SNMP Requests
    ------------------------------------------------------------------------

    SUMMARY

    Under certain conditions, it is possible to bypass the SNMP ACL on Cisco
    routers and gain ANMP Read / Write privileges.

    DETAILS

    In order to gain R/W SNMP access on the router, the following conditions
    must exist:
    a) RW community string is known
    b) Access list policy is known
    c) Access to the SNMP RW command will occur from the a.b.c.d network
    (External).
    d) No access lists present on TFTP server address.

    Under these conditions, if the server holds an ACL like:
    access-list 1 permit 192.168.1.0 0.0.0.255
    snmp-server community public RO
    snmp-server community datest RW 1

    By spoofing an SNMP packet, it is possible to bypass the ACL. The idea is
    to spoof a packet with a different source IP than the attacker has or more
    accurately, a source IP which is allowed by the Router SNMP ACL.

    Workarounds:
    Enforce an ACL on the TFTP used in conjunction with the router, or disable
    SMNP if possible.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mati@see-security.com> muts.
    The original article can be found at:
    <http://new.remote-exploit.org/index.php/SNMP_Spoof>
    http://new.remote-exploit.org/index.php/SNMP_Spoof

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buffer Overflow)"

    Relevant Pages

    • [NEWS] DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Exploitation of a buffer overflow vulnerability in DataRescue Inc.'s ... Interactive Disassembler Pro (IDA Pro) allows attackers to execute ... The import directory lists all the ...
      (Securiteam)
    • [UNIX] Mpg123 Remote Client-Side Heap Corruption (Exploit, readstring())
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... unsigned int p_requestaddr; ... void printe; ... lists the platforms in a loop. ...
      (Securiteam)
    • [UNIX] Apache mod_negotiation XSS and Http Response Splitting
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache mod_negotiation XSS and Http Response Splitting ... * A type map which explicitly lists ... sanitized, in the response header, it could result in a Http Response ...
      (Securiteam)
    • [NT] McAfee FreeScan ActiveX Buffer Overflow and Information Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... award-winning McAfee VirusScan engine, FreeScan searches for viruses, ... The code below lists about 25 different parameters which the ... '&H0017=all users/start menu/programs ...
      (Securiteam)
    • [NT] Lyris ListManager Multiple SQL Injection, information Disclosure and Authentication Bypassing
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and growing in-house email lists, as well as creating highly effective ... Lack of proper input validation with Lyris ListManager allows attackers to ... After the installer finishes, the password is permanently set to 'lyris' ...
      (Securiteam)