HP ProCurve Switch SNMP Write Denial Of Service Vulnerability

Bugtraq ID:	5336
Class:	Design Error
CVE:	CVE-2002-1426
Remote:	Yes
Local:	No
Published:	Jul 27 2002 12:00AM
Updated:	Jul 11 2009 02:56PM
Credit:	Published by FX <[email protected]>, kim0 <[email protected]> and Zet <[email protected]>.
Vulnerable:	HP Procurve Switch 4000M
Not Vulnerable:

HP ProCurve Switch SNMP Write Denial Of Service Vulnerability

An issue has been reported with the HP ProCurve 4000M Switch.

An attacker with SNMP write access to the device may write to the SNMP variable .iso.3.6.1.4.1.11.2.36.1.1.2.1.0. If more than 85 characters are written to this variable, the device will crash the next time it accepts a connection to either the configured telnet or HTTP port.

HP ProCurve Switch SNMP Write Denial Of Service Vulnerability

The following snmpwalk command is supplied as a proof of concept:

snmpwrite <switch_ip> private .iso.3.6.1.4.1.11.2.36.1.1.2.1.0 s `perl -e 'print "A"x85;'`

HP ProCurve Switch SNMP Write Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP ProCurve Switch SNMP Write Denial Of Service Vulnerability

References:

• hp procurve switches & hubs (HP)
  
• Phenoelit Advisory (Phenoelit Group)