CVE-1999-0254: Critical severity Sun Solaris vulnerability
A hidden SNMP community string in HP OpenView allows remote attackers to modify MIB tables and obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove any hidden or default SNMP community strings in HP OpenView and replace them with a strong, unique community string. Ensure no undocumented community strings remain configured.
HP OpenView (SNMP) on Oracle Solaris / ZFS hosts SNMP community string = remove hidden/default; set to a strong unique community string - Configuration
Disable the SNMP service in HP OpenView if it is not required for management or monitoring.
HP OpenView SNMP service = disabled if not required - Compensating control
Restrict access to SNMP management interfaces to trusted hosts/IP ranges using network controls (firewall, ACLs, or management network isolation) to limit exposure of SNMP community strings.
- Operational
Audit MIB tables and HP OpenView logs for unauthorized modifications, and assume sensitive information may have been exposed. Rotate any credentials, community strings, or keys that may have been disclosed and review affected systems for compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0254?
CVE-1999-0254 is considered a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-1999-0254?
To fix CVE-1999-0254, ensure that SNMP community strings are secured and not left hidden or vulnerable.
What software is affected by CVE-1999-0254?
CVE-1999-0254 specifically affects HP OpenView running on Oracle Solaris 2.6.
What are the risks associated with CVE-1999-0254?
The risks of CVE-1999-0254 include unauthorized modification of MIB tables and leakage of sensitive information to attackers.
Is CVE-1999-0254 still relevant today?
Yes, CVE-1999-0254 remains relevant as it highlights vulnerabilities in SNMP configurations that can still be exploited in legacy systems.