multiple SNMP implementations HMAC authenticationspoofing

2008.06.13
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-287


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

2008/06/09 #2008-006 multiple SNMP implementations HMAC authentication spoofing Description: Some SNMP implementations include incomplete HMAC authentication code that allows spoofing of authenticated SNMPv3 packets. The authentication code reads the length to be checked from sender input, this allows the sender to supply single byte HMAC code and have a 1 in 256 chance of matching the correct HMAC and authenticating, as only the first byte will be checked. The sender would need to know a valid username. Currently Net-SNMP and UCD-SNMP are known to be vulnerable, other SNMP implementations may also be affected. The eCos project includes code derived from UCD-SNMP and is therefore also affected. Affected version: Net-SNMP <= 5.4.1, <= 5.3.2, <= 5.2.4 UCD-SNMP, all versions eCos, all versions Fixed version: Net-SNMP >= 5.4.1.1, >= 5.3.2.1, >= 5.2.4.1 UCD-SNMP, N/A eCos, N/A Credit: this issue was reported by CERT/CC, it is tracked as VU#878044. CVE: CVE-2008-0960 Timeline: 2008-06-05: CERT/CC reports VU#878044 to oCERT requesting joint coordination 2008-06-05: contacted affected vendors 2008-06-06: added eCos to affected packages 2008-06-09: patched net-snmp packages released 2008-06-09: advisory release References: http://sourceforge.net/forum/forum.php?forum_id=833770 http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_i d=12694&atid=456380 http://www.kb.cert.org/vuls/id/878044 Links: http://www.net-snmp.org http://www.ece.ucdavis.edu/ucd-snmp http://ecos.sourceware.org Permalink: http://www.ocert.org/advisories/ocert-2008-006.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"

References:

http://www.kb.cert.org/vuls/id/MIMG-7ETS87
http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z
http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q
http://www.kb.cert.org/vuls/id/878044
https://bugzilla.redhat.com/show_bug.cgi?id=447974
http://www.securityfocus.com/bid/29623
http://www.securityfocus.com/archive/1/archive/1/493218/100/0/threaded
http://www.openwall.com/lists/oss-security/2008/06/09/1
http://www.ocert.org/advisories/ocert-2008-006.html
http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380
http://sourceforge.net/forum/forum.php?forum_id=833770
http://secunia.com/advisories/30596
http://secunia.com/advisories/30574
http://rhn.redhat.com/errata/RHSA-2008-0528.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top