Re: SNMP concerns

["Jim Franz" <franz400@xxxxxxxxxxxx>]

It was interesting to see on the Cert site this morning that "IBM" is listed
as
"Not Vulnerable" on Jan 4-2002 (inside it says "AIX" only)
later in the list is "IBM z-Series" with status "unknown" on Jan 7-2002.
No iSeries listed. p-Series is vulnerable because of Microsoft.

2nd point - I would not be comfortable with only the firewall protecting
your
network. A decent trojan planted anywhere in your network (from all your
users that continue to open attachments!) could easily mount an attack
from inside.

3rd point - on the iSeries we lived with a very outdated (and with CERT
warning) DNS server while AIX enjoyed the latest (and more secure)
version. I feel NO COMFORT that AIX snmp is ok and the iSeries
is traditionally silent.

<please correct me if wrong>
1. SNMP is not started automatically unless STRTCPSVR *ALL is run,
or if the Change SNMP Attributes (CHGSNMPA) has autostart=*yes.
To not autostart - run CHGSNMPA AUTOSTART(*NO)

2. Just scanned the Simple Network Management Protocol (SNMP) Support
Version 4 book SC41-5412-00 (1997) on website. Not knowing much it seems
like
part of OS400 support SNMPv1 and part is SNMPv2. But this statement
bothers me, page 33 says"The DPI API for OS/400 is the 2.0 level of the
protocol.
This is designed to be highly compatible with SNMPv2 even if the SNMP Agent
is SNMPv1. (again, this is the only book I could find and is from 1997)

3. The Tips and Tools for Securing Your iSeries has specific snmp tips. (see
Info Center)
secure port 161 (well known for snmp)
set snmp server autostart to *no
<clip>
SNMP relies on a community name for access. Conceptually, the community name
is similar to a password. The community name is not encrypted. Therefore, it
is vulnerable to sniffing. Use the Add Community for SNMP (ADDCOMSNMP)
command to set the manager internet address (INTNETADR) parameter to one or
more specific IP addresses instead of *ANY. You can also set the OBJACC
parameter of the ADDCOMSNMP or CHGCOMSNMP commands to *NONE to prevent the
managers in a community from accessing any MIB objects. This is intended to
just be done temporarily to deny access to managers in a community without
removing the community. </clip>

Does anyone know a source in IBM to clear this up?
jim franz



----- Original Message -----
From: "Patrick Townsend" <patownsend@patownsend.com>
To: <midrange-l@midrange.com>
Sent: Friday, February 15, 2002 7:41 PM
Subject: Re: SNMP concerns


> Fritz,
>
> Interesting. The CERT notice calls out two primary areas of vulnerability.
> One in SNMP managers and one in SNMP agents. The AS/400 doesn't have a
> native manager, so that part doesn't apply to the AS/400. But it certainly
> has an SNMP agent and sub-agent support.
>
> The denial of service is a well known type of attack. Good firewall and
> router implementations will help prevent damage from outside sources.
Since
> SNMP is almost never run over the Internet, these ports shouldn't be open
> anyway. I suspect the risk from an internal SNMP denial of service attack
is
> pretty small. But, as the alert points out, there are steps you can take
to
> minimize this type of attack.
>
> The vulnerabilities in SNMPv1 are another matter. I couldn't find any
place
> where IBM addresses the AS/400 (ahem, I mean iSeries). IBM clearly states
> that AIX is not vulnerable. But no mention of iSeris. I hope they will
> comment on this for the iSeries platform.
>
> Patrick
> ----- Original Message -----
> From: "Fritz Hayes" <fhayes@spiritone.com>
> To: <midrange-l@midrange.com>
> Sent: Friday, February 15, 2002 2:33 PM
> Subject: RE: SNMP concerns
>
>
> > The CERT Vulnerability Note VU#854306 indicated that the SNMP processing
> > of
> > GetRequest, SetRequest, GetNextRequest, GetResponse, and Trap has
> > vulnerablities.
> > These weaknesses include "denial-of-service conditions, format string
> > vulnerabilities, and buffer overflows."  In addition, "some
> > vulnerabilities do not require the request message to use the correct
> > SNMP community string".
> >
> > Which means, the SNMP service can be used to compromise OS/400.
> >
> > IBM responded with:  "Based upon the results of running the test suites
> > we have determined that our version of SNMP shipped with AIX is NOT
> > vulnerable."
> >
> > If Dr. Frank's hypothesis is right, IBM SNMP implementation is probably
> > the same for AIX as it is for OS/400.  Which makes my worries go away -
> > - Right??????
> >
> > I know that SNMP is used regularly on internal networks.  Some people
> > are even using it to drive their AS/400 printers.  A couple of customers
> > want to remotely manage their equipment, using VPN connections on the
> > Internet.  SNMP could be the right tool, but only if internal hackers
> > can be kept out!  With the CERT notification,  and in general, is a
> > properly configured AS/400 susceptible to SNMP attacks?
> >
> > Best Regards
> >
> > Fritz Hayes
> > Atwater Associates
> > <snip>
> >
> > |
> > |We run SNMP on the AS/400 and provide SNMP options in our
> > |products. What concerns do you have?
> > |
> > <snip>
> > |>
> > |> So, who out there is running and using SNMP on their AS/400, iSeries
> > |> box?
> > |>
> > |> A second question, who is using the SNMP protocol over the Internet?