Security Advisory - SNMP vulnerability on Huawei multiple products

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

Base Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)

1. Prerequisite:

Must have an SNMP community string and have the access to the device;

2. Attacking procedure:

Note: If the NMS has been deployed, exercise caution when checking whether the following preventive measures have an impact on NMS functions.

The following workarounds are only applicable to the products of NE5000E/ MA5200G / NE40E&80E/ATN/NE40&80/NE20E-X6/NE20/ME60/CX600/CX200&CX300/MAG9811. For the workarounds of the other involving products, please refer to the Configuration Guide. 

1．It is suggested to disable the SNMP function (the function of SNMP is disabled by default on Huawei devices). Or do not define local users, use RADIUS or HWTACACS.

Query the status of SNMP and SNMP agent is not enabled.

[HUAWEI]display snmp-agent  sys-info

2．When Huawei devices enable SNMP, the default version to be used is V3. It is not suggested to use V1 and V2.

Query the status of SNMP:

[HUAWEI]display snmp-agent  sys-info

If the query result is displayed as:  

SNMP version running in the system: 

SNMPv1 SNMPv2c SNMPv3

Disable SNMP V1/V2:

[HUAWEI]undo  snmp-agent  sys-info version  v1 v2c

3．If SNMP V1/V2 protocol is applied, it is needed to block SNMP V1/V2 by using access controls or firewalls;

The configuration example:

[HUAWEI] acl 2001

[HUAWEI-acl-basic-2001] rule 5 permit source 1.1.1.2 0.0.0.0

[HUAWEI-acl-basic-2001] rule 6 deny source 1.1.1.1 0.0.0.0

[HUAWEI-acl-basic-2001] quit

[HUAWEI] snmp-agent community read cipher security-read mib-view userinfo acl 2001

[HUAWEI] snmp-agent community write cipher security-write mib-view userinfo acl 2001

Note: The above-mentioned community names are just used as examples. For the actual configuration, the community names with high complexity are needed.

4．If SNMP V1/V2 protocol is applied, it is suggested to disable the SNMP V1/V2 mib entries for querying user account;

The configuration example:

[HUAWEI] snmp-agent mib-view include userinfo internet

[HUAWEI] snmp-agent mib-view excluded userinfo snmpUsmMIB

[HUAWEI] snmp-agent mib-view excluded userinfo snmpVacmMIB

[HUAWEI] snmp-agent mib-view excluded userinfo hwLocalUserTable

[HUAWEI] snmp-agent mib-view excluded userinfo hwCfgOperateTable

[HUAWEI] snmp-agent mib-view excluded userinfo hwCollectTable

[HUAWEI] snmp-agent community read cipher security-read mib-view userinfo

[HUAWEI] snmp-agent community write cipher security-write mib-view userinfo

Note: If the NMS has been deployed, exercise caution when checking whether the following preventive measures have an impact on NMS functions.

The following workarounds are only applicable to the products of NE5000E/ MA5200G / NE40E&80E/ATN/NE40&80/NE20E-X6/NE20/ME60/CX600/CX200&CX300/MAG9811. For the workarounds of the other involving products, please refer to the following Configuration Guide, the download link is:

http://support.huawei.com/enterprise/NewsReadAction.action?newType=0301&contentId=NEWS1000001151&idAbsPath=0301_10001&nameAbsPath=Services%2520News

1．It is suggested to disable the SNMP function (the function of SNMP is disabled by default on Huawei devices). Or do not define local users, use RADIUS or HWTACACS.

Query the status of SNMP and SNMP agent is not enabled.

[HUAWEI]display snmp-agent  sys-info

2．When Huawei devices enable SNMP, the default version to be used is V3. It is not suggested to use V1 and V2.

Query the status of SNMP:

[HUAWEI]display snmp-agent  sys-info

If the query result is displayed as:  

SNMP version running in the system: 

SNMPv1 SNMPv2c SNMPv3

Disable SNMP V1/V2:

[HUAWEI]undo  snmp-agent  sys-info version  v1 v2c

3．If SNMP V1/V2 protocol is applied, it is needed to block SNMP V1/V2 by using access controls or firewalls;

The configuration example:

[HUAWEI] acl 2001

[HUAWEI-acl-basic-2001] rule 5 permit source 1.1.1.2 0.0.0.0

[HUAWEI-acl-basic-2001] rule 6 deny source 1.1.1.1 0.0.0.0

[HUAWEI-acl-basic-2001] quit

[HUAWEI] snmp-agent community read cipher security-read mib-view userinfo acl 2001

[HUAWEI] snmp-agent community write cipher security-write mib-view userinfo acl 2001

Note: The above-mentioned community names are just used as examples. For the actual configuration, the community names with high complexity are needed.

4．If SNMP V1/V2 protocol is applied, it is suggested to disable the SNMP V1/V2 mib entries for querying user account;

The configuration example:

[HUAWEI] snmp-agent mib-view include userinfo internet

[HUAWEI] snmp-agent mib-view excluded userinfo snmpUsmMIB

[HUAWEI] snmp-agent mib-view excluded userinfo snmpVacmMIB

[HUAWEI] snmp-agent mib-view excluded userinfo hwLocalUserTable

[HUAWEI] snmp-agent mib-view excluded userinfo hwCfgOperateTable

[HUAWEI] snmp-agent mib-view excluded userinfo hwCollectTable

[HUAWEI] snmp-agent community read cipher security-read mib-view userinfo

[HUAWEI] snmp-agent community write cipher security-write mib-view userinfo

Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades, or obtain them through Huawei worldwide website at http://support.huawei.com/support/. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.

This vulnerability is found by Kurt Grutzmacher. The Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

For security problems about Huawei products and solutions, please contact PSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.

2012-10-25 V1.0 INITIAL

2012-11-13 V1.1 UPDATED update the affected version and temporary fix

2012-11-24 V1.2 UPDATED update the temporary fix

2013-01-05 V1.3 UPDATED update the affected version, temporary fix and software fixes

None