SCO OpenServer SNMPD Default Community Vulnerability
BID:973
Info
SCO OpenServer SNMPD Default Community Vulnerability
| Bugtraq ID: | 973 |
| Class: | Configuration Error |
| CVE: |
CVE-2000-0147 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | This vulnerability was published in an NAI Security Advisory on February 7, 2000. |
| Vulnerable: |
SCO Open Server 5.0.5 |
| Not Vulnerable: | |
Discussion
SCO OpenServer SNMPD Default Community Vulnerability
A vulnerability exists in the default configuration of the Simple Network Management Protocol (SNMP) daemon, as shipped with SCO's OpenServer 5.0.5 operating system. By default, the community name 'private' is set in the /etc/snmpd.comm file. An attacker can use the "write" capabilities of this community to alter routing tables, tear down connections, and a myriad of other attacks, many of which could result in the compromise of the machine.
A vulnerability exists in the default configuration of the Simple Network Management Protocol (SNMP) daemon, as shipped with SCO's OpenServer 5.0.5 operating system. By default, the community name 'private' is set in the /etc/snmpd.comm file. An attacker can use the "write" capabilities of this community to alter routing tables, tear down connections, and a myriad of other attacks, many of which could result in the compromise of the machine.
Exploit / POC
SCO OpenServer SNMPD Default Community Vulnerability
Using standard snmp tools, it should be possible to alter any snmp variable. For example:
snmpset -v 1 targethost private system.sysname.0 'foo'
should set the system.sysname variable to 'foo'
Using standard snmp tools, it should be possible to alter any snmp variable. For example:
snmpset -v 1 targethost private system.sysname.0 'foo'
should set the system.sysname variable to 'foo'
Solution / Fix
SCO OpenServer SNMPD Default Community Vulnerability
Solution:
Editing /etc/snmpd.comm, removing the 'private' string from the list of communities, and restarting the snmpd process will remove this vulnerability.
A better solution, for sites not utilizing SNMP, is to remove the service altogether.
Solution:
Editing /etc/snmpd.comm, removing the 'private' string from the list of communities, and restarting the snmpd process will remove this vulnerability.
A better solution, for sites not utilizing SNMP, is to remove the service altogether.
References
SCO OpenServer SNMPD Default Community Vulnerability
References:
References:
- Buffer overflow in /usr/sbin/in.i2odialogd (SCO)
- NAI Security Advisories (Formerly Secure Networks Inc. Advisories) (Network Associates Inc.)
- Vendor Homepage (SCO)