Warning: Cisco RW community backdoor.

Mailman List Mirror (Read Only)
1

----- Forwarded message from "James A. T. Rice" <jamesr@rd.bbc.co.uk> -----
If your router responds to `snmpwalk router.isp.net.uk ILMI`, you
probabally will want to do the following to disable it:
   conf t
   snmp-server community ILMI RO 99
   access-list 99 deny any log
(pick another spare access-list if 99 isn't available)

should be RW not RO

Anyone with a Smartnet contract have a response from Cisco yet? I really
need to get my own Smartnet number.

2

Interesting enough, I tried this on a dozen routers and not a peep out of
one. All running new 12.0 or 12.1.

Jason

3

Same here - no response from our Cisco's - all 12.x stuff.

Any idea what is actually affected?

Mark Radabaugh
VP, Amplex
(419)833-3635
mark@amplex.net

4

A table of IOS with the "feature" and without the "feature" will be made
public today.

Regards,

Chris Hallman
NSE NSP North Florida
3660 Maguire Blvd., Suite 200
Orlando, Fl. 32803
407-897-8744 office
407-903-7591 off-site office
800-365-4578 pager
email: mailto:challman@cisco.com

5

Cisco 12.1(1a) seems to have it:

groupname: ILMI security model:v1
readview :v1default writeview: v1default
notifyview: <no notifyview specified>
row status: active access-list: 99

groupname: ILMI security model:v2c
readview :v1default writeview: v1default
notifyview: <no notifyview specified>
row status: active access-list: 99

Deepak Jain
AiNET