Re: One more 3Com SNMP vulnerability

From: Peter Hicks (Peter.Hicksat_private)
Date: Wed Sep 01 1999 - 06:00:40 PDT

Next message: Werner Koch: "Re: ProFTPD 1.2.0pre4 available"

Previous message: Sven Berkvens: "Local DoS on network by unpriviledged user using setsockopt()"
Next in thread: fredat_private: "Re: One more 3Com SNMP vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi there

I'm running version 3.17 firmware on the SSII Hub 10's here, and the
securityUserTable is only visible if you use a read-write community string.


Peter.

----- Original Message -----
From: Nerijus Krukauskas <nkrukauskasat_private>
To: <BUGTRAQat_private>
Sent: 30 August 1999 14:43
Subject: One more 3Com SNMP vulnerability


> Hi,
>
>   It seems that 3Com does not pay much atention how its SNMP is
> implemented. In 3Com SuperStack II hubs MIB there's an OID:
> .1.3.6.1.4.1.43.10.4.2. Its name decodes to
>
.iso.org.dod.internet.private.enterprises.a3Com.generic.security.securityUse
rTable.
> What You need to know that's read-only community and this OID will give
you
> entire table of communities (read-write and read-only).
>   If somebody knows how to contact 3Com with such reports forward this
info
> to them. Half an hour exploring 3Com web site i found no e-mail's (not
even
> supportat_private). Amazing...
>
> --
> Nerijus Krukauskas                   Bank of Lithuania
> Division head                        IT department, Networking division
> Tel. +370-2-680731                   Zirmunu 151
> nkrukauskasat_private                 2012 Vilnius, Lithuania
>
>

Next message: Werner Koch: "Re: ProFTPD 1.2.0pre4 available"
Previous message: Sven Berkvens: "Local DoS on network by unpriviledged user using setsockopt()"
Next in thread: fredat_private: "Re: One more 3Com SNMP vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:01:08 PDT