OSVDB ID: 10206 Title: Symantec Firewall/Gateway Default SNMP String Allows Device Configuration Disclosure/Modification |
Info |
|
|
Dates |
||||
|
|
Description |
Symantec Firewall/Gateway products contain a flaw that may allow a malicious user to read from and write to the devices configuration setting via SNMP. The issue is triggered because the Firewall/Gateway products use a standard default community string and do not allow the administrator to disable SNMP or change the community string. It is possible that the flaw may allow disclosure and modification of device settings resulting in a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Misconfiguration Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Security Software |
Solution |
Upgrade to firmware version 1.63 or higher for Firewall/VPN products and firmware build 622 or later for Gateway products, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
rigelksecurity.com - Security & Advisory Services Inc