exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

snmp-spoof.txt

snmp-spoof.txt
Posted Jun 11, 2008
Authored by Andrea Barisani | Site ocert.org

Some SNMP implementations include incomplete HMAC authentication code that allows spoofing of authenticated SNMPv3 packets. Net-SNMP versions equal and below 5.4.1, 5.3.2, and 5.2.4 are affected. All versions of eCos and UCD-SNMP are affected.

tags | advisory, spoof
advisories | CVE-2008-0960
SHA-256 | ff4e903a00dd6d273a0bb7e2abb1a38e4e9b9f70707af856d4c0989f041b050e

snmp-spoof.txt

Change Mirror Download

2008/06/09 #2008-006 multiple SNMP implementations HMAC authentication spoofing

Description:

Some SNMP implementations include incomplete HMAC authentication code that
allows spoofing of authenticated SNMPv3 packets.

The authentication code reads the length to be checked from sender input,
this allows the sender to supply single byte HMAC code and have a 1 in 256
chance of matching the correct HMAC and authenticating, as only the first
byte will be checked. The sender would need to know a valid username.

Currently Net-SNMP and UCD-SNMP are known to be vulnerable, other SNMP
implementations may also be affected. The eCos project includes code derived
from UCD-SNMP and is therefore also affected.

Affected version:

Net-SNMP <= 5.4.1, <= 5.3.2, <= 5.2.4
UCD-SNMP, all versions
eCos, all versions

Fixed version:

Net-SNMP >= 5.4.1.1, >= 5.3.2.1, >= 5.2.4.1
UCD-SNMP, N/A
eCos, N/A

Credit: this issue was reported by CERT/CC, it is tracked as VU#878044.

CVE: CVE-2008-0960

Timeline:
2008-06-05: CERT/CC reports VU#878044 to oCERT requesting joint coordination
2008-06-05: contacted affected vendors
2008-06-06: added eCos to affected packages
2008-06-09: patched net-snmp packages released
2008-06-09: advisory release

References:
http://sourceforge.net/forum/forum.php?forum_id=833770
http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380
http://www.kb.cert.org/vuls/id/878044

Links:
http://www.net-snmp.org
http://www.ece.ucdavis.edu/ucd-snmp
http://ecos.sourceware.org

Permalink:
http://www.ocert.org/advisories/ocert-2008-006.html

--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close