INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Multiple Cisco products contain either of two authentication vulnerabilities inthe Simple Network Management Protocol version 3 (SNMPv3) feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. |
| PLATFORM: | Cisco IOS Cisco IOS-XR Cisco Catalyst Operating System (CatOS) Cisco NX-OS Cisco Application Control Engine (ACE) Module Cisco ACE Appliance Cisco ACE XML Gateway Cisco MDS 9000 Series Multilayer Fabric Switches |
| DAMAGE: | Data leak or configuration changes. |
| SOLUTION: | Upgrade to the appropriate version. |
| VULNERABILITY ASSESSMENT: |
The risk is LOW. Successful exploitation of these vulnerabilities could result in the disclosure of sensitive information on a device or allow an attacker to make configuration changes to a vulnerable device that is based on the SNMP configuration. |
| CVSS 2 BASE SCORE: TEMPORAL SCORE: VECTOR: |
5.4 4.2 (AV:A/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) |
[***** Start Cisco Security Advisory Document ID: 107408 *****]
Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
Multiple Cisco products contain either of two authentication vulnerabilities in the Simple Network Management Protocol version 3 (SNMPv3) feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. These vulnerabilities could allow the disclosure of network information or may enable an attacker to perform configuration changes to vulnerable devices. The SNMP server is an optional service that is disabled by default in Cisco products. Only SNMPv3 is impacted by these vulnerabilities. Workarounds are available for mitigating the impact of the vulnerabilities described in this document.
Note: SNMP versions 1, 2 and 2c are not impacted by these vulnerabilities.
The United States Computer Emergency Response Team (US-CERT) has assigned Vulnerability Note VU#878044 
to these vulnerabilities.
Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0960 has also been assigned to these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml.
[Expand all sections] [Collapse all sections]
Affected Products Vulnerable Products The following Cisco products are vulnerable.
Note: The SNMP server is disabled by default. These vulnerabilities only impact devices that are configured for SNMPv3.
To determine the version of SNMP configured in Cisco IOS, CatOS and IOS-XR, log in to the device and issue the show snmp group command. The security model field indicates the version of SNMP configured. The output "usm" is the abbreviation for user-based security model and this indicates SNMPv3 is configured.
Cisco IOS
router#show snmp group
groupname: test security model:v3 auth
readview : v1default writeview: <no writeview specified>
notifyview: <no notifyview specified>
row status: active
Cisco CatOS
5500-1 (enable) show snmp group
Security Model: v3
Security Name: userv3
Group Name: groupv3
Storage Type: nonvolatile
Row Status: active
Cisco IOS-XR
RP/0/RP0/CPU0:ios#show snmp group
groupname: test security model:usm
readview : v1default writeview: -
notifyview: v1default
row status: nonVolatile
IronPort C-Series, X-Series, and M-Series appliances utilize code covered by this advisory, but are not susceptible to any security risk. IronPort C-Series, X-Series, and M-Series incorporate the libraries under the advisory to provide anonymous read-only access to system health data. There is no risk of escalated authorization privileges allowing a 3rd party to make any configuration changes to the IronPort devices. IronPort S-Series and Encryption Appliances are not affected by this advisory. This announcement has also been posted on the IronPort Support Portal, available to IronPort customers: https://supportportal.ironport.com/irppcnctr/srvcd?u=http://secure-support.soma.ironport.com/announcement&sid=900016
Products Confirmed Not Vulnerable Details SNMP defines a standard mechanism for remote management and monitoring of devices in an Internet Protocol (IP) network.
There are three general types of SNMP operations: "get" requests to request information, "set" requests that modify the configuration of a remote device, and "trap" messages that provide a monitoring function. SNMP requests and traps are transported over User Datagram Protocol (UDP) and are received at the assigned destination port numbers 161 and 162, respectively.
SNMPv3 provides secure access to devices by authenticating and encrypting packets over the network. RFC2574 defines the use of HMAC-MD5-96 and HMAC-SHA-96 as the possible authentication protocols for SNMPv3.
Vulnerabilities have been identified in the authentication code of multiple SNMPv3 implementations. This advisory identifies two vulnerabilities that are almost identical. Both are specifically related to malformed SNMPv3 packets that manipulate the Hash Message Authentication Code (HMAC). The two vulnerabilities may impact both Secure Hashing Algorithm-1 (SHA-1) and Message-Digest Algorithm 5 (MD5). The vulnerabilities described in this document can be successfully exploited using spoofed SNMPv3 packets.
These vulnerabilities are documented in the following Cisco Bug IDs:
Note: Although multiple software defects are listed, this advisory only identifies two vulnerabilities. Because different Cisco products require their own fixes, additional Bug IDs have been assigned.
Top of the section Close Section Vulnerability Scoring Details Impact Software Versions and Fixes