CVE-2000-0147: Low severity SCO OpenServer vulnerability

Published Feb 8, 2000

Updated

snmpd in SCO OpenServer has an SNMP community string that is writable by default, which allows local attackers to modify the host's configuration.

Affected Software

1 affected component

SCO OpenServer=5.0.5

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove snmpd (SCO OpenServer) from your environment.
Uninstall or disable the snmpd service if SNMP functionality is not required on the host.
Configuration
Disable writable SNMP community strings in the snmpd configuration so the community is not writable by default.
snmpd (SCO OpenServer) SNMP community write access = disabled
Configuration
Change the SNMP community string from the default to a non-default, strong value and ensure only intended (read or read-only) access is configured.
snmpd (SCO OpenServer) SNMP community string = non-default, secret value
Compensating control
Until snmpd is reconfigured or removed, restrict access to SNMP management interfaces to trusted administrators (for example via firewall rules, host-based access controls, or limiting the service binding) to reduce the risk of local modification.
Operational
Audit the host for any unauthorized configuration changes made via SNMP and restore affected configurations; review local accounts and privileges for signs of misuse.

Feb 8, 2000

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Feb 16, 2000

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

CVE-2000-0147 is considered to be of moderate severity as it allows local attackers to modify the host's configuration.

To fix CVE-2000-0147, change the SNMP community string to a more secure setting and restrict access to the SNMP daemon.

CVE-2000-0147 affects systems running SCO OpenServer version 5.0.5.

CVE-2000-0147 is a security vulnerability related to improper access controls for the SNMP community string.

CVE-2000-0147 cannot be exploited remotely as it requires local access to the system.