PT-2006-6101 · 3Com · 3Com Switch Ss3 4400

Published 2006-10-25 · Updated 2017-07-20 · CVE-2006-5382

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 3Com Switch SS3 4400 versions 5.11, 6.00, 6.10 and earlier

Description The issue allows remote attackers to read the SNMP Read-Write Community string, which can be used to conduct unauthorized actions. This is achieved by sending normally restricted management packets on the device, causing the community string to be returned.

Recommendations For versions 5.11, 6.00, 6.10 and earlier, restrict access to the SNMP service to minimize the risk of exploitation. As a temporary workaround, consider disabling the SNMP Read-Write Community string until a patch is available. Avoid using the device's management interface from untrusted networks until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5382

Affected Products

3Com Switch Ss3 4400

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-5382 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29779 · Note
• http://3com.com/securityalert/alerts/3COM-06-004.html · Note
• http://vupen.com/english/advisories/2006/4184 · Note
• http://securityfocus.com/bid/20736 · Note
• http://secunia.com/advisories/22818 · Note
• http://securitytracker.com/id?1017128 · Note