[Shorewall-users] Multiple Vulnerabilities in SNMP

Martinez, Mike (MHS-ACS)
Mon, 25 Feb 2002 15:19:12 -0000

Hi All,

CERT has released a bulletin concerning multiple vulnerabilities in SNMP.

CERT=AE Advisory CA-2002-03 Multiple Vulnerabilities in Many Implementations
of the Simple Network Management Protocol (SNMP)

http://www.cert.org/advisories/CA-2002-03.html

One of the suggestion is to do ingress filtering (firewall rules)

they suggest blocking:

snmp     161/udp     # Simple Network Management Protocol (SNMP)
snmp     162/udp     # SNMP system management messages

but then they also suggest some other ports and also suggest blocking some
rpc service related to snmp....

my questions is do the existing policies in shorewall block snmp by default?
or do you have to setup some rules and/or modify the policies file?

Mike