CERT snmp advisory and SuSE
Hi Can someone from SuSE confirm if SuSE package ucdsnmp is also vulnerable for the vulnerabilities listed on this advisory. I could not find SuSE name on the list but that is another issue. Thanks in advance CERT Advisory CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP) Original release date: February 12, 2002 Last revised: -- Source: CERT/CC Systems Affected Products from a very wide variety of vendors may be affected. See Vendor Information for details from vendors who have provided feedback for this advisory. In addition to the vendors who provided feedback for this advisory, a list of vendors whom CERT/CC contacted regarding these problems is available from http://www.kb.cert.org/vuls/id/854306 http://www.kb.cert.org/vuls/id/107186 Many other systems making use of SNMP may also be vulnerable but were not specifically tested.
Hi, On Tuesday 12 February 2002 22:38, Togan Muftuoglu wrote:
Can someone from SuSE confirm if SuSE package ucdsnmp is also vulnerable for the vulnerabilities listed on this advisory. I could not find SuSE name on the list but that is another issue.
I do not speak for SuSE, but since ucdsnmp is now Net-SNMP (http://sourceforge.net/projects/net-snmp) and Net-SNMP is listed as vulnerable I would consider the SuSE package vulnerable as well until further notice. It is probably a good idea to temporarily disable snmp on your SuSE systems (and other OS as well until patches are out), just to be on the safe side. Regards, Martin -- Martin Leweling Institut fuer Planetologie, WWU Muenster Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany
Hi Martin
* Martin Leweling;
Hi,
I do not speak for SuSE, but since ucdsnmp is now Net-SNMP (http://sourceforge.net/projects/net-snmp) and Net-SNMP is listed as vulnerable I would consider the SuSE package vulnerable as well until further notice.
That is how I interpreted yet confirmation is always good :-)
It is probably a good idea to temporarily disable snmp on your SuSE systems (and other OS as well until patches are out), just to be on the safe side.
Currently I have snmp allowed on trusted host (private ip) and all requests are denied by ipchains -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx
Hi
Can someone from SuSE confirm if SuSE package ucdsnmp is also vulnerable for the vulnerabilities listed on this advisory. I could not find SuSE name on the list but that is another issue.
The SuSE ucdsnmp package is vulnerable, too. If you use it, then please disable the server until you have installed the update packages. These packages are in the making and will be available shortly, along with an announcement. SuSE will show up on CERT advisories as well in the future.
Thanks in advance
CERT Advisory CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP)
Thanks,
Roman.
--
- -
| Roman Drahtmüller
On Wed, Feb 13, 2002 at 11:28:54AM +0100, Roman Drahtmueller wrote:
Hi
Can someone from SuSE confirm if SuSE package ucdsnmp is also vulnerable for the vulnerabilities listed on this advisory. I could not find SuSE name on the list but that is another issue.
The SuSE ucdsnmp package is vulnerable, too. If you use it, then please disable the server until you have installed the update packages. These packages are in the making and will be available shortly, along with an announcement.
SuSE will show up on CERT advisories as well in the future.
...hopefully not too often, though ;-) -- Mit freundlichen Gruessen / Yours sincerely Wolfram Schlich; Berghof, D-56626 Andernach-Kell; +49-(0)2636-941194;
* Roman Drahtmueller wrote on Wed, Feb 13, 2002 at 11:28 +0100:
The SuSE ucdsnmp package is vulnerable, too. If you use it, then please disable the server until you have installed the update packages. These packages are in the making and will be available shortly, along with an announcement.
I just checked: http://suse.de/de/support/security/index.html but it seems that even the rsync-annoucement is missing... Maybe this page is not automatically updated. I assume the SNMP packages are not yet finished, or did I miss something? Have a nice weekend, anyone! oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
* Steffen Dettmer (steffen@dett.de) [020222 02:35]:
I just checked: http://suse.de/de/support/security/index.html but it seems that even the rsync-annoucement is missing... Maybe this page is not automatically updated.
No, unfortunately it's not. I'll contact the webmaster about it.
I assume the SNMP packages are not yet finished, or did I miss something?
They're almost finished. The security team did a full audit of version 4.2.3 so we have to update all the SuSE versions to 4.2.3. -- -ckm
On Fri, Feb 22, 2002 at 11:23:37AM -0800, Christopher Mahmood wrote:
I assume the SNMP packages are not yet finished, or did I miss something?
They're almost finished. The security team did a full audit of version 4.2.3 so we have to update all the SuSE versions to 4.2.3.
well, already 2 weeks: usually SuSE is quicker in security fixes releasing... Are you all working on suse 8.0 or what ? :) Regards, Olivier -- _________________________________________________________________ Olivier Mueller - om@8304.ch - PGPkeyID: 0E84D2EA - Switzerland qmail projects: http://omail.omnis.ch - http://webmail.omnis.ch
participants (7)
-
Christopher Mahmood -
Martin Leweling -
Olivier M. -
Roman Drahtmueller -
Steffen Dettmer -
Togan Muftuoglu -
Wolfram Schlich