[NEWS] Bypassing Cisco SNMP Access Lists Using Spoofed SNMP Requests

From: SecuriTeam (support_at_securiteam.com)
Date: 08/08/05

  • Next message: SecuriTeam: "[NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buffer Overflow)" 
    To: list@securiteam.com
Date: 8 Aug 2005 17:32:14 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Bypassing Cisco SNMP Access Lists Using Spoofed SNMP Requests
    ------------------------------------------------------------------------

    SUMMARY

    Under certain conditions, it is possible to bypass the SNMP ACL on Cisco
    routers and gain ANMP Read / Write privileges.

    DETAILS

    In order to gain R/W SNMP access on the router, the following conditions
    must exist:
    a) RW community string is known
    b) Access list policy is known
    c) Access to the SNMP RW command will occur from the a.b.c.d network
    (External).
    d) No access lists present on TFTP server address.

    Under these conditions, if the server holds an ACL like:
    access-list 1 permit 192.168.1.0 0.0.0.255
    snmp-server community public RO
    snmp-server community datest RW 1

    By spoofing an SNMP packet, it is possible to bypass the ACL. The idea is
    to spoof a packet with a different source IP than the attacker has or more
    accurately, a source IP which is allowed by the Router SNMP ACL.

    Workarounds:
    Enforce an ACL on the TFTP used in conjunction with the router, or disable
    SMNP if possible.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mati@see-security.com> muts.
    The original article can be found at:
    <http://new.remote-exploit.org/index.php/SNMP_Spoof>
    http://new.remote-exploit.org/index.php/SNMP_Spoof

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buffer Overflow)"

    Relevant Pages