AdventNet products are free from the CERT Vulnerability issue (VU#878044)

The US-CERT (United States Computer Emergency Readiness Team) has described an SNMPv3 Authentication vulnerability in their Vulnerability Note VU#878044.

In the description, they have given the following;

With regard to our AdventNet SNMP products, namely

• AdventNet SNMP API Java Edition
• AdventNet SNMP Agent Toolkit Java Edition
• AdventNet SNMP Agent Toolkit C Edition
• AdventNet Simulation Toolkit
• AdventNet SNMP Utilities
• AdventNet Agent Tester
• AdventNet SNMP Adaptor for JMX
• AdventNet Web NMS

We would like to state that the products DO NOT have the above mentioned authentication vulnerability at all, because the products have already checked for the correct length of the HMAC code. A packet with a shortened HMAC code in the authenticator field, is altogether dropped and appropriate error is notified. So, this vulnerability issue (VU#878044) is not present in any of our AdventNet products. Hence there is no specific action to be taken by the users of AdventNet products, with regard to this vulnerability issue.

Please feel free to contact us for any clarification.

References:

1. oCERT Advisory http://www.ocert.org/advisories/ocert-2008-006.html
2. US-CERT -- Vulnerability Note VU#878044 -- SNMPv3 improper HMAC validation allows authentication bypass http://www.kb.cert.org/vuls/id/878044
3. US-CERT -- SNMPv3 Authentication Bypass vulnerability -- http://www.us-cert.gov/cas/techalerts/TA08-162A.html