Solved

SNMP v1 and later versions vulnerabilities?

Posted on 2006-10-30
2
485 Views
Last Modified: 2010-04-11
Can you please tell me the vulnerabilities in SNMP v1 and later versions, i cant get a detailed paper on SNMP vulnerabilities only in detail, they just use to describe the protocol in detail and tell in 2 or 3 lines the vulnerabilities in it. I want detail on the attacks so i can defend more accurately.
0
Comment
Question by:shairankhan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 17836539
Aside from various implementation problems like buffer overflows, the underlying protocol issues are as follows:

SNMPv1: essentially does no authentication

SNMPv2: uses Community Strings for authentication, which are sent over the net in the clear where anyone can pick them up and reply them. Also all clients use the same Community String, so they all have the same level of access (other than really coarse level of read-write vs. read-only)

SNMPv3: Replaces Community Strings with shared cryptographic secrets so at least they can't be replayed.
0
 
LVL 3

Accepted Solution

by:
mahe2000 earned 125 total points
ID: 17842868
a couple of comments to what chris calabrese said, in snmp v2 you usually have two kind of access with different communities on for read-only access (usually "public" community but it can be changed) and one for write access (usually "private" community but it can be changed).

in snmp version 3 you can set up what you want your users can access.
0

Featured Post

Enroll in June's Course of the Month

June's Course of the Month is now available! Every 10 seconds, a consumer gets hit with ransomware. Refresh your knowledge of ransomware best practices by enrolling in this month's complimentary course for Premium Members, Team Accounts, and Qualified Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Liquid Web and Plesk discuss how to simplify server management with a single tool  in their webinar.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question