SNMP 'GETBULK' Reflection DDoS

Medium Nessus Plugin ID 76474

Synopsis

The remote SNMP daemon is affected by a vulnerability that allows a reflected distributed denial of service attack.

Description

The remote SNMP daemon is responding with a large amount of data to a 'GETBULK' request with a larger than normal value for 'max-repetitions'. A remote attacker can use this SNMP server to conduct a reflected distributed denial of service attack on an arbitrary remote host.

Solution

Disable the SNMP service on the remote host if you do not use it.
Otherwise, restrict and monitor access to this service, and consider changing the default 'public' community string.

See Also

http://www.nessus.org/u?8b551b5c

http://www.nessus.org/u?bdb53cfc

Plugin Details

Severity: Medium

ID: 76474

File Name: snmp_getbulk_reflection_ddos.nasl

Version: 1.7

Type: remote

Family: SNMP

Published: 2014/07/11

Updated: 2018/08/08

Dependencies: 19762, 11153

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

Required KB Items: SNMP/community

Exploited by Nessus: true