CERT-In Vulnerability Note
CIVN-2006-0128
Remote Code Execution Vulnerability in SNMP
Original Issue Date:December 13, 2006
Severity Rating: MEDIUM
Systems Affected
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP Service Pack 2
- Microsoft Windows XP Professional x64 Edition
- Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
- Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
- Microsoft Windows Server 2003 x64 Edition
Overview
A remote code execution vulnerability exists in SNMP Service that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system.
Description
Simple Network Management Protocol SNMP allows administrators to remotely manage network devices such as servers, workstations and routers etc.
The SNMP service allows incoming SNMP requests to be serviced by the local computer. SNMP includes agents that monitor activity in network devices and report to the network console workstation. This is a remote code execution vulnerability caused by an unchecked buffer in the SNMP service. An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system. The message could then cause the affected system to execute code and allow the attacker to take complete control of the affected system.
Workaround
Restrict the IP addresses that are allowed to manage the computer. Block UDP Port 161 or other specially configured SNMP port at firewall for all unsolicited inbound communication from Internet. Use a personal firewall to protect against network-based attacks. Disable the SNMP service if not required.
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin MS06-074
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms06-074.mspx
References
Secunia
http://secunia.com/advisories/23307/
Security Tracker
http://www.securitytracker.com/alerts/2006/Dec/1017371.html
FrSirt
http://www.frsirt.com/english/advisories/2006/4967
CVE Name
CVE-2006-5583
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|