[ http://www.rootshell.com/ ]
Date:         Mon, 2 Nov 1998 11:24:30 -0600
From:         Tim Yocum <tyocum@WWA.COM>
Subject:      APC PowerNet SNMP vulnerability
Several days ago after installing an APC PowerNet SNMP module (v3.0.0,
firmware revision 82.9.D MWD) into a SmartUPS 2200 series UPS, I decided to
try out a few of the well-known DoS attacks on it after getting the module
up on the network. The results didn't surprise me too much - the module will
reboot after being hit with nestea/teardrop, and probably others. I
contacted APC about the problem last week and received two replies:
"This device was not meant to withstand malicious attacks.  That is why it
should be protected behind a firewall along with other network devices."and
"There is no fix scheduled for this.  The device is more secure when used on
a secured network protected by a firewall."
I'm somewhat disturbed by response from APC as it'd be quite simple for
someone to interrupt SNMP data gathering from these devices since it takes
the module anywhere from 20 seconds to a full 3 minutes to reboot.
Workarounds are obvious; either put the SNMP module on a non-routable IP
block or put it behind a firewall.
Maybe APC will fix this problem, but at this point I wouldn't keep my hopesup.
Regards,- Tim--------------------------------------------------------
Tim Yocum               -       NT Systems Administrator
Verio, Inc.             -       http://chicago.verio.net
----------------------------------------------------------------------------
Date:         Wed, 25 Nov 1998 09:51:53 +0000
From:         Paul Mansfield <paulm@UK.PSI.COM>
Subject:      APC PowerNet SNMP Adapter Security Issues - Beta Firmware
              Available (fwd)
I asked APCC about the vulnerabilities in their software having read about them
in this and other forums (fora?), and initially received a reply saying they
were working on it, and they took the problem seriously.
Today I received a report that new software was available in beta. Those of you
who are exposed to the DoS-ability of your UPS units might want to see if you
can get hold of this beta.Reply quoted below, stripped of personal information.
Paul
/* My parachute came with a "lifetime" warranty. Why am I'm not reassured ? */
---------- Forwarded message ----------Date: Tue, 24 Nov 1998 17:50:05 -0500
Subject: APC PowerNet SNMP Adapter Security Issues - Beta Firmware  Available
Paul,The protocol stack fixes for the SNMP Adapter are complete.  We are Beta
testing the new firmware changes during the next several weeks. The SNMP
Adapter v3.0.2.b can now successfully survive the following attacks:
Ping of Death, Nestea, Bonk, Jolt, Land, Newtear, Syndrop, Teardrop,Winnuke
I would like you to help ensure that we have resolved the vulnerabilities that
you have described in your previous e-mails by beta testing the new firmware.
If you are interested in helping us verify the new firmware, please let meknow.
Regards,-snip -American Power Conversion1-800-788-2208-snip --snip -