Flaws in how SNMP (Simple Network Management Protocol) version one is implemented in a raft of products could allow attackers to stage denial of service attacks, take over systems and threaten the Internet, according to a new alert from the federally funded computer security body CERT/CC (Computer Emergency Response Team/Coordination Center).
Information about the vulnerabilities has already begun to surface in attacker communities, CERT/CC said, and administrators should act quickly to apply available patches. One security company, TruSecure Corp., has already obtained documents and tools from underground sources verifying attacker knowledge of the issues.
SNMP is a protocol used by many vendors to enable network and systems administrators to remotely monitor and configure any number of network devices, including routers, switches and operating systems, CERT/CC said. SNMP “is very, very widely used,” according to Russ Cooper, surgeon general of TruSecure. “It’s used in most corporations and certainly in all ISPs (Internet service providers).”
The vulnerabilities were first discovered by the Secure Programming Group of Finland’s Oulu University, according to CERT/CC. The team at Oulu found multiple vulnerabilities in the way SNMP version one is implemented in many vendors’ products. The vulnerabilities involve the way in which SNMP implementations handle warning and error messages, along with requests, CERT/CC said.
The flaws in the products are particularly serious because “many of the affected products provide key services to the Internet infrastructure. Large-scale outages of these devices could disable significant portions of the global network,” CERT/CC said in its alert.
Though the vulnerabilities could lead to serious problems, according to TruSecure’s Cooper, he thinks that the fallout will not be as serious as the Code Red or Nimda worms. The circumstances involved in this case and that of the two worms are “significantly different,” he said, noting that since hundreds of products may be vulnerable, it will be difficult, if not impossible, to write automated attack code that runs on all of them.
“It’s a denial of service attack and probably nothing more,” he said.
However, CERT/CC’s Marty Lindner is not so sure. An automated attack tool could be written to take advantage of the flaws, according to Lindner, who is the team leader for incident handling at CERT/CC.
Although he said that it is hard to compare these flaws to Code Red and Nimda, he did allow that “the number of devices that are potentially at risk might be much higher.”
Because of this, administrators need to read CERT/CC’s alert and really take the time to understand it, because there is no single patch that will fix the problem, Lindner said.
Vendors whose products are affected include Avaya Inc., 3Com Corp., Caldera Systems Inc., Cisco Systems Inc., Compaq Computer Corp., Computer Associates International Inc., Hewlett-Packard Co., Juniper Networks Inc., Lotus Software Group, Lucent Technologies Inc., Microsoft Corp., Netscape Communications Corp., Nokia Corp., Novell Inc., Silicon Graphics Inc. and Sun Microsystems Inc. Different vendors have responded to the vulnerabilities in different ways, with many of them already offering patches, though some have not, according to the alert.
Though some vendors have issued fixes, the challenge to network administrators may still be great, according to CERT/CC’s alert. Administrators will need to apply patches and make changes to many different kinds of devices throughout their networks, changes which may not be easy to make, the organization said.
TruSecure, Cooper’s company, obtained a copy of the suite of tests created by the Oulu team from contacts in the “black hat,” or malicious, underground, indicating that potential attackers already have knowledge of the vulnerabilities and may be working on attack tools, he said. But the tests take a long time to run, and may not provide potential attackers enough useful feedback, so attacks may not be immediate, he said.
Nonetheless, Cooper said, “worrying sooner (rather than later) is probably a good idea.”
CERT/CC, the team at Oulu and many vendors have been worrying about this issue for months, according to CERT/CC’s Lindner. The Finnish team discovered the flaws in the middle of last year and contacted CERT/CC, which has been working with vendors to address the problem since then, he said. Recently, enough information about the issues has become public that the parties decided it was time to issue an alert, he said.
SNMP has been around for at least 10 years and is administered by an international standards body, Cooper said.
SNMP was “designed with no security in mind. Most of the earlier protocols were sent that way,” he said. SNMP contains no authentication provisions for users, data or systems and sends its requests and messages as essentially clear, unencrypted data, he said.
CERT/CC’s Lindner agreed, calling SNMP “not a really strongly secured protocol.”
There have been other, more secure versions of SNMP, but those have not been as widely accepted as the first, less secure version, he said.
That the protocol has been vulnerable nearly since its inception raises interesting issues, Cooper said.
“(SNMP’s underlying) vulnerabilities have existed for at least 10 years and none of these hundreds of vendors have done anything to prevent it,” he said. “They’ve been in there all this time.”
The team from Oulu University has materials to test products for the flaw at http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/0100.html/.
A list of affected vendors and the progress of their fixes is available at http://www.cert.org/advisories/CA-2002-03.html#vendors/.
CERT/CC, in Pittsburgh, is at http://www.cert.org/.
The Oulu group’s Web site is at http://www.ee.oulu.fi/research/ouspg.
TruSecure, in Herndon, Va., is at http://www.trusecure.com/.
