SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   SuperStack 3 Vendors:   3Com
3Com SuperStack 3 Switch Discloses SNMP Community String to Remote Users
SecurityTracker Alert ID:  1017128
SecurityTracker URL:  http://securitytracker.com/id/1017128
CVE Reference:   CVE-2006-5382   (Links to External Site)
Date:  Oct 27 2006
Impact:   Disclosure of system information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Models 4400/4400PWR/4400SE/4400FX; Firmware version 5.11, 6.00, and 6.10 and prior
Description:   A vulnerability was reported in 3Com's SuperStack 3 switch. A remote user can determine the SNMP community string password.

A remote user on the management VLAN can cause the target device to disclose the SNMP Read-Write community string. With this information, the remote user can perform certain operations on the target switch, including the disabling of ports or possibly modifying the VLAN configuration.

Andrew Brennan discovered this vulnerability.

Impact:   A remote user can determine the SNMP community string, which can then be used to modify part of the device configuration.
Solution:   The vendor has issued a fix, available at:

http://pa.3com.com

The 3Com advisory is available at:

http://www.3com.com/securityalert/alerts/3COM-06-004.html

Vendor URL:  www.3com.com/securityalert/alerts/3COM-06-004.html (Links to External Site)
Cause:   Access control error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC