VU#225404: HP/H3C and Huawei networking equipment h3c-user snmp vulnerability

Vulnerability Note VU#225404
HP/H3C and Huawei networking equipment h3c-user snmp vulnerability

Original Release date: 24 Oct 2012 | Last revised: 24 Oct 2012

Overview

HP/H3C and Huawei networking equipment contains a vulnerability which could allow an attacker to access administrative functions of the device using systems network manage…

VU#225404: HP/H3C and Huawei networking equipment h3c-user snmp vulnerability

Vulnerability Note VU#225404
HP/H3C and Huawei networking equipment h3c-user snmp vulnerability

Original Release date: 24 Oct 2012 | Last revised: 26 Oct 2012

Overview

HP/H3C and Huawei networking equipment contains a vulnerability which could allow an attacker to access administrative functions of the device using systems network management protocol (SNMP) requests.

Description

According to the researcher’s report.:

“HP/H3C and Huawei networking equipment suffers from a serious weakness in regards to their handling of Systems Network Management Protocol (SNMP) requests for protected h3c-user.mib and hh3c-user.mib objects.

Details
Huawei/H3C have two OIDs, ‘old’ and ‘new’:

old: 1.3.6.1.4.1.2011.10
new: 1.3.6.1.4.1.25506

Most devices support both formats.

The MIBs h3c-user.mib and hh3c-user.mib, for the purpose of this document, will be referred to as (h)h3c-user.mib. This MIB defines the internal table and objects to “Manage configuration and Monitor running state for userlog feature.”

This means there are some cool objects with data in this MIB penetration testers or malicious actors would want to get their dirty little hands on. Most objects are only accessible with the read/write community string.

In the revision history of (h)h3c-user.mib, version 2.0 modified the MAX-ACCESS from read-only to read-create the following objects within the (h)h3cUserInfoEntry sequence:

(h)h3cUserName
(h)h3cUserPassword
(h)h3cAuthMode
(h)h3cUserLevel

The purpose of these objects are to provide the locally configured users to those with a valid SNMP community. After the change only those with the read-write community string should have access, however this was not the case and the code still retained the earlier access of read-only.

So if you have the SNMP public community string then you have the ability to view these entries.”

Additional information can be found in the researcher’s report

Impact

A remote unauthenticated attacker can access administrative functions of the device using systems network management protocol (SNMP) requests.

Solution

Update

HP: Customers are advised to check HP’s SSRT100962 support document for instructions.

Huawei Security Advisory states: “On Oct. 19, Huawei PSIRT noticed the media report titled “Demo of “serious” networking vulnerabilities cancelled at HP’s request-Saturday’s Toorcon talk was to discuss risks posed by gear from H3C and Huawei” . Huawei PSIRT responded immediately and proactively coordinate Kurt Grutzmacher, US-CERT, CERT/CC and CNCERT to handle the issue. On Oct. 24, Huawei PSIRT finally acquired the technical details of the vulnerabilities from the public channel of US-CERT and launched shortly the vulnerability analysis and investigation to develop the mitigation measures. The first version of “SNMP vulnerability on Huawei multiple products” SA was released on Oct. 25. The investigation is still ongoing. Huawei PSIRT will keep updating the SA. Please refer to the above link.

According to the researcher’s report:

“By itself this is already bad but most users who do any of the following may already be protected:

Use complex SNMP community strings or disable SNMPv1
Have disabled the mib entries for (h)h3c-user
Block SNMP using access controls or firewalls
Do not define local users, use RADIUS or TACACS+

More specific routines can be found in the vendor’s release.”

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedHewlett-Packard CompanyAffected06 Aug 201224 Oct 2012
Huawei TechnologiesAffected-26 Oct 2012
3com IncUnknown06 Aug 201206 Aug 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal
7.7
E:F/RL:OF/RC:C

Environmental
7.7
CDP:MH/TD:H/CR:ND/IR:ND/AR:ND

References

http://grutztopia.jingojango.net/2012/10/hph3c-and-huawei-snmp-weak-access-to.html
https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03515685&ac.admitted=1351086123601.876444892.492883150
http://support.huawei.com/enterprise/NewsReadAction.action?newType=0301&contentId=NEWS1000001069&idAbsPath=0301_10001&nameAbsPath=Services%2520News

Credit

Thanks to Kurt Grutzmacher for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs:
CVE-2012-3268

Date Public:
23 Oct 2012

Date First Published:
24 Oct 2012

Date Last Updated:
26 Oct 2012

Document Revision:
15

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#441363: HP Virtual SAN appliance root shell command injection

Vulnerability Note VU#441363
HP Virtual SAN appliance root shell command injection

Original Release date: 17 Aug 2012 | Last revised: 17 Aug 2012

Overview

The HP Virtual SAN appliance version 9.5 is susceptible to a root shell command injection (CWE-77) vulnerability.

VU#960468: HP Arcsight Logger and Connector appliances cross-site scripting vulnerability

Vulnerability Note VU#960468
HP Arcsight Logger and Connector appliances cross-site scripting vulnerability

Original Release date: 06 Aug 2012 | Last revised: 06 Aug 2012

Overview

HP’s Arcsight Connector appliance v6.2.0.6244.0 and Arcsight Logger appliance v5.2.0.6288.0 (and possibly other versions) contain a file import facility which …

VU#859230: HP Business Service Management 9.12 remote code execution vulnerability

Vulnerability Note VU#859230
HP Business Service Management 9.12 remote code execution vulnerability

Original Release date: 16 May 2012 | Last revised: 16 May 2012

Overview

The HP Business Service Management (HPBSM) application contains a remote code execution vulnerability. Version 9.12 has been reported to be affected but other versio…

VU#885499: HP StorageWorks P2000 G3 directory traversal vulnerability

Vulnerability Note VU#885499
HP StorageWorks P2000 G3 directory traversal vulnerability
OverviewHP StorageWorks P2000 G3 contains a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information.
I. DescriptionHP StorageWorks P2000 G3 contains an embedded webserver which is vulnerable to a directory traversal vulnerability which may allow a remote, unauthenti…