Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Preemptive Protection against Castle Rock Computing SNMPc Network Manager Community String Stack Vulnerability

Subscribe

Check Point Reference: CPAI-2008-106
Date Published:
Severity:
Source: Secunia Advisory: SA30036
Industry Reference(s): CVE-2008-2214
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Castle Rock Computing SNMPc Network Manager 7.1
Vulnerability Description
A buffer overflow vulnerability has been discovered in Castle Rock Computing SNMPc Network Manager. Castle Rock Computing SNMPc is a secure distributed network management system that uses the Simple Network Management Protocol (SNMP) to communicate with other networks. A remote attacker may exploit this vulnerability to inject and execute arbitrary code on a target system.
Update/Patch Available
Update to version 7.1.1:
Castle Rock Computing
Vulnerability Details
The vulnerability is due to a boundary error in the SNMPc Network Manager when processing malformed SNMP TRAP packets. A remote attacker may trigger this vulnerability via an SNMP TRAP message with an overly long community string. Successful exploitation of this issue will allow the attacker to execute arbitrary code on the vulnerable system.

Protection Overview
By enabling this protection, IPS-1 will detect and block malformed SNMP packets. No update is required to address this vulnerability.

Users are protected against this vulnerability if the protection against Long SNMP Community Name has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Network Security > SNMP, and select the SNMP Attacks protection group.
3. Click Long SNMP Community Name (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: snmp_attacks
Description: long_commname_alert