CVE-1999-0517 An SNMP community name is the default (e.g. public), null, or missing on an Infiniband Switch

Asset ID:	1-72-2171362.1
Update Date:	2018-05-09
Keywords:

Solution Type Problem Resolution Sure

Solution 2171362.1 : CVE-1999-0517 An SNMP community name is the default (e.g. public), null, or missing on an Infiniband Switch

Applies to:

Sun Datacenter InfiniBand Switch 36 - Version All Versions and later
Sun Network QDR InfiniBand Gateway Switch - Version All Versions and later
Information in this document applies to any platform.

Symptoms

A security scanner flags
CVE-1999-0517 An SNMP community name is the default (e.g. public), null, or missing.
for the Infiniband Switch management IP address.

Changes

No changes were done to Simple Network Management Protocol (SNMP) configuration.

Cause

This CVE is a configuration proposal, it is flagged when a SNMP community name is the default (e.g. the string "public").

If this is an intended configuration, this can be probably kept.

What you can configure depends on your environment.

Solution

Option 1 - disable SNMP

If you do not use SNMP on the infiniband switch and Exadata, you can potentially disable it.
See Sun Datacenter InfiniBand Switch 36 Topic Set - Managing SNMP Services (CLI)

Access the Oracle ILOM CLI ( See Accessing Oracle ILOM From the CLI).

-> set /SP/services/snmp servicestate=disabled
Set ’servicestate’ to ’disabled’

Option 2 - change the community string

If you use SNMP, you can change the community strings.

This is done on all systems and related management software (e.g. Enterprise Manager).

On the IB switch, in general, a new snmp community name can be configured on the ILOM of the IB switches.
It's described in
Sun Datacenter InfiniBand Switch 36 Topic Set - Managing SNMP Services (CLI)

For example, to add the community newcom:

-> create /SP/services/snmp/communities/newcom permission=rw
Created /SP/services/snmp/communities/newcom

The SNMP community newcom is added.

Then you can disable the unwanted community :

- delete community private:

-> delete /SP/services/snmp/communities/private

Option 3 - use SNMPv3

If your environment supports it, you can also use just SNMPv3,
see Sun Datacenter InfiniBand Switch 36 Topic Set - Configure the SNMP Service (CLI)

Note - Before any re-configuration on an Engineered System, pls. check with support for your Engineered System specifics.

Attachments

This solution has no attachment