Despite patch, today's systems still vulnerable to 2002 flaw

For the last week, I've written that Dan Kaminsky undertook unprecedented action in coordinating a variety of vendors in secret over the last six months. Ari Takanen, co-founder and chief technology officer of Codenomicon, wrote to challenge that notion.

In an e-mail on Thursday, Takanen cited his work on a Simple Network Management Protocol version 1 (SNMPv1) flaw back in 2002 as an example. Like Domain Name System, SNMP is a fundamental element of the Internet.

I wrote: "There have been other multiparty patch releases, but never has there been one on such a massive scale. It took someone with the gravitas and reputation of Kaminsky to pull together the affected parties."

Takanen writes: "Well, actually that is not true. Our SNMP case was secret for nine months after reporting it to relevant vendors, and as far as I know it involved more than 100 vendors and other organizations (1,000+ people). We saw all possible attempts to disclose it, but even public disclosure lists appreciated the stand that CERT-US chose to take."

CERT-US released its advisory on February 12, 2002, after word of the flaw leaked.

Takanen goes on to say Codenomicon provides a commercial tool to defect the SNMPv1 flaw as part of its quality assessment process.

The funny thing is six years later, the tool still finds active systems vulnerable.

Takanen, who advocates nonpublic disclosure of security flaws, said, "This just proves that reporting individual bugs for fame and fortune does not motivate the vendors to improve their quality assurance processes."

[Penguinisto]

SNMP isn't really as vital to the Internet's continued existence as I get the impression you think it to be... it's great if you want to monitor machines, but otherwise it's not got a whole lot of use out in the Internet in general, esp. compared to DNS, which world+dog uses (and doing a simple snmpwalk over SNMPv1 doesn't even require passwords... if the netAdmin is stupid enough to leave ports 161-162 wide open to the Internet, he kinda deserves what he gets).

[DanKaminsky]

Sounds like Ari did a great job, and though he was foiled by someone leaking (as we were terrified of through this entire process!) what he was working on was certainly cool. I wish we, as an industry, did more of it! I don't know about the assertion the companies aren't working on improving their quality assurance procedures. The whole concept of Codenomicon -- a very cool company, I'd like to point out -- is that companies would like to find their bugs before outsiders do.

As for fame and fortune...well, DNS servers stay unpatched for a long time. I'm just trying to get people to pay attention to these nodes which really are at the core of their network. So far, so good...