Engineers typically use the SNMP to centrally manage the various devices connected to one another via the same network. "SNMP and basic pinging of devices are the two things network engineers rely on to gauge the basic health of their network," said David Dittrich, a senior security engineer at the University of Washington. Routers and switches -- the hardware devices responsible for directing data around office networks and the Internet -- are the most common devices with functions that use SNMP. But any remotely managed device is likely to have the software onboard, Dittrich said, including PCs and printers. "Using SNMP, a printer can tell you if it's out of paper," Dittrich said. Although many network-hardware makers have patched the software for their devices, CERT's Lindner believes that the majority of network devices connected to the Internet are vulnerable. The problems acutely affect large Internet service providers, the providers of large-bandwidth data services that form the backbone of the Internet. Those services typically make use of hundreds, if not thousands, of routers and switches, which in many cases are centrally managed. But many telecommunications providers have not trusted SNMP data, said Christopher Budd, program manager for Microsoft's security response centre. Much of the data is sent in the clear, without encryption, leaving the protocol with little security. "It's untrusted by default, so those big network operation centers would be using it in a very limited, controlled manner," Budd said. Large companies tend to have an entirely separate network for their SNMP data to keep it safe from prying eyes, he said. Microsoft's products do not load SNMP by default, but are vulnerable if the network service has been loaded, said Budd. Microsoft released its own advisory on Tuesday, highlighting a way to work around the problem until the software giant posts a patch.
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section.
See the Software News Section for the latest headlines on everything from peer to peer clients to Office software and beyond.
Have your say instantly, and see what others have said. Go to the Security forum.
Let the editors know what you think in the Mailroom.
