| VID |
20016 |
| Severity |
30 |
| Port |
161 |
| Protocol |
UDP |
| Class |
Snmp |
| Detailed Description |
The SNMP community name is guessable, and allows anyone who can guess the name the ability to receive responses to queries from the system. By allowing remote users access to the SNMP Agent with guessable community names, remote attackers can use SNMP to gain valuable information about the machine such as information on network devices, current open connections, etc. |
| Recommendation |
1. If SNMP is not required, disable the service.
- UNIX : Kill the snmp process found from the list of the processes and remove it from any RC scripts.
- Solaris 10, Solaris 11:
# svcadm disable svc:/application/management/snmpdx
- Enterprise Linux 6.4, CentOS 6.4, Fedora 19:
# /etc/init.d/snmpd stop
# rpm -e (snmp name)
- Windows : Stop the SNMP service and change Startup type to Disabled (Execute services.msc -> Services -> SNMP Service)
2. If you need SNMP for network management, make sure it is properly configured with private community names
- Unix : Configure 'get-community-name' line in /etc/snmpd.conf
- Router : Type 'show config' and make sure 'snmp-community' is properly configured
- Windows : Configure the community name with private one (Execute services.msc -> Services -> SNMP Service -> 'Security' tab)
3. Filter incoming traffic to the 161/udp port |
| Related URL |
CVE-1999-0516 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
1241 (ISS) |
|
