4 ms·

Am I missing something? This is like saying "remote code execution possible if the attacker knows your ssh password"

• omginternets 10y ago
  Yeah, I've been scratching my head over this as well.
• wmf 10y ago
  SNMP should not allow remote code execution under any circumstances.
  • rdtsc 10y ago
    It's how attack surfaces work. Yes, it shouldn't allow. But SNMP invovles that pesky ASN.1 encoding, written often by cheap contractors or people who don't really care about security much. So it allow for various buffer overflows, timing attacks, it is basically a large hatch to open and start jiggling all the gears in there and see what gives.
• jlgaddis 10y ago
  One case that immediately springs to mind is a network monitoring system exposed to the Internet in order to provide a live "status" page, either for the staff, users, or the public. That system would have SNMP access to the ASA firewalls (which are otherwise normally well-protected). Gaining access to that public host would then grant you RCE to the protected internal firewall. If the public host were hosted, say, at AWS/DO/etc., and used a VPN for access to those internal network devices, you've just gained access to the internal network itself. (Note also that a) SNMP uses UDP and b) community strings, v1 and v2c at least, are plain-text. SNMPv3 has a bit more protection but it's not as widely used.)
  • therein 10y ago
    So what you're saying is it would be trivial for, say, a state actor to tap into the fiber optic cables and snoop for this unencrypted community strings going over UDP? And then to use them to gain access to internal networks? Well fuck, NSA was inside pretty much any corporate network they wanted then.
    • jlgaddis 10y ago
      Pretty much. See previous disclosures discussing how the NSA captures, for example, configuration files for Cisco devices passing over the Internet in e-mail, TFTP, etc. If you've sent a community string over the Internet, it's quite possible that they have it too.
  • oldsj 10y ago
    Edit: I see what you're saying now, if the NMS is in the cloud for some reason, the attacker could get the community string since it's sent clear text. Really glad one of the first things I did when I got my new job was to get us on snmp v3 Wouldn't the firewall be just as exposed to the internet? After all, that's what it's job is: to protect the internal network from the external. In your scenario the attacker would first have to hack the NMS to get the community string on the firewall running SNMP
• Someone1234 10y ago
  Someone correct me if I'm wrong, but isn't the SNMP community string sent in plain text? If that's the case (and it certainly used to be the case), and someone compromised the LAN they could theoretically sniff the community string and use this exploit to own the appliance. SNMPv3 supporters different, more secure, authentication methods but a lot or organisations continue to use SNMPv2 because it is a simpler more streamlined setup. Plus the appliances support different user levels, so you'd still potentially be able to use this to escalate access.