[29743] in bugtraq
Medium Vulnerability in SNMP on Linsys BEFVP41
daemon@ATHENA.MIT.EDU (Branson Matheson)
Sat Apr 12 04:08:57 2003
Date: 9 Apr 2003 18:48:53 -0000
Message-ID: <20030409184853.18270.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Branson Matheson <branson@windborne.net>
To: bugtraq@securityfocus.com
While the following is not a critical vulnerability, it is a serious
problem for those that are implementing these VPN routers in production
environments.
Problem:
The MIB information available from the default 'public' community name on
the external interface of a Linksys VPN router includes information about
the hosts on the inside of the protected network including routes, hardware
addresses ( MAC ), and some configuration information. What is NOT
available include information about the VPN's configured, any preshared
keys, VPN routes, or endpoint IP's.
Testability:
install the net-snmp package and run the following on any Linksys router
that has not had it's community names altered:
snmpwalk -v 1 -c public {ip}
This has been tested on versions 1.40.3f and 1.40.4 ( latest ) version.
Solution:
Change the community names configured in the 'password' section of the
VPN routers web based config tool. There is no current way to disable SNMP.
Vendor:
I have sent numerous mails to the vendor concerning this issue starting
about 90 days ago. The last several have been ignored.
