1

We have detected "Default or Guessable SNMP community names: public" vulnerability in one of our printer through Nexpose. The remediation states we have to secure SNMP installation. What does it mean should we have to disable SNMP services on that particular printer or we have to upgrade SNMP version to SNMPv3?

2

Rapid7 have written up about this on their blog. They are basically saying that if SNMP isn't required, then it should be disabled so the attack surface is reduced, however if it is required then you should upgrade to SNMPv3 as it has security improvements:

  • Confidentiality – Encryption of packets to prevent snooping by an unauthorized source.
  • Integrity – Message integrity to ensure that a packet has not been tampered while in transit including an optional packet replay protection mechanism.
  • Authentication – to verify that the message is from a valid source.

@Daisetsu has pointed out that only SNMPv1 and SNMPv2c use a community string. SNMPv3 instead uses an authentication key, a secret key used for authentication and a privacy key, a secret key used for encryption. (This can be seen in the RFC section 3.1, 4a and 6a).

Both these keys should be different and complex to make guessing attacks difficult, following similar requirements to those linked in the Rapid7 blog.

  • 1
    FYI community strings are only applicable to SNMPv1, and SNMPv2c. SNMPv3 exclusively uses auth and priv passwords. SNMPv3 also supports different algorithms, (DES, 3DES, AES). If possible, pick the strongest algorithm. Most systems also allow separate users for READ, and WRITE functionalities. Some OIDs which are writable allow you to execute functions like a reboot. – Daisetsu Oct 29 '18 at 2:41
  • Thanks everyone this was helpful. Although what we did is upgrading it to SNMPv3. – Benz Nov 4 '18 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.