IBM OS/400 Malformed SNMP Requests Remote Denial Of Service Vulnerability

Bugtraq ID:	14798
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2005 12:00AM
Updated:	Sep 09 2005 12:00AM
Credit:	The vendor disclosed this issue.
Vulnerable:	IBM OS/400 V5R1M0
Not Vulnerable:

IBM OS/400 Malformed SNMP Requests Remote Denial Of Service Vulnerability

IBM OS/400 is susceptible to a remote denial of service vulnerability affecting its SNMP services.

This issue presents itself due to the error logging functionality of the SNMP process. When the SNMP process receives malformed SNMP packets, it logs information regarding the packet to its job log.

By default, the job log is configured for '*NOWRAP' for the 'Job message queue full action'. Once the job log is full, the SNMP jobs inappropriately abort.

This issue allows remote attackers to crash the SNMP jobs on affected computers, denying service to further legitimate SNMP traffic.

IBM OS/400 Malformed SNMP Requests Remote Denial Of Service Vulnerability

An exploit is not required.

IBM OS/400 Malformed SNMP Requests Remote Denial Of Service Vulnerability

Solution:
IBM has released a document, along with fixes to address this issue. Please see the referenced document for further information.

IBM OS/400 Malformed SNMP Requests Remote Denial Of Service Vulnerability

References:

• SI03361 - OSP-PAR SNMP DENIAL OF SERVICE VULNERABILITY DOCUMENTED IN C (IBM)