3Com SuperStack 3 Switch Discloses SNMP Community String to Remote Users
|
|
SecurityTracker Alert ID: 1017128
|
|
SecurityTracker URL: http://securitytracker.com/id?1017128
|
|
CVE Reference: CVE-2006-5382
(Links to External Site)
|
Date: Oct 27 2006
|
Impact: Disclosure of system information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): Models 4400/4400PWR/4400SE/4400FX; Firmware version 5.11, 6.00, and 6.10 and prior
|
Description: A vulnerability was reported in 3Com's SuperStack 3 switch. A remote user can determine the SNMP community string password.
A remote user on the management VLAN can cause the target device to disclose the SNMP Read-Write community string. With this information,
the remote user can perform certain operations on the target switch, including the disabling of ports or possibly modifying the
VLAN configuration.
Andrew Brennan discovered this vulnerability.
|
Impact: A remote user can determine the SNMP community string, which can then be used to modify part of the device configuration.
|
Solution: The vendor has issued a fix, available at:
http://pa.3com.com
The 3Com advisory is available at:
http://www.3com.com/securityalert/alerts/3COM-06-004.html
|
Vendor URL: www.3com.com/securityalert/alerts/3COM-06-004.html (Links to External Site)
|
Cause: Access control error
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 27 Oct 2006 00:21:01 -0400
Subject: 3Com Switch Information Disclosure
|
http://www.3com.com/securityalert/alerts/3COM-06-004.html
CVE-2006-5382
|
|
