Sycamore Networks

CERT Advisory CA-2002-03

CERT Advisory CA-2002-03 (http://www.cert.org/advisories/CA-2002-03.html)

Sycamore Networks, Inc. is aware of reports that there may be vulnerabilities within certain implementations of Simple Network Management Protocol - Version 1 (SNMPv1) code utilized throughout the telecommunications industry.

Upon being notified of such SNMP-related security and operational issues, Sycamore Networks immediately began a program within its Product Assurance organization to determine how best to assess the potential impact to its entire product portfolio. As further information regarding this matter becomes available, this notification will be promptly updated.

Regardless of the outcome of this ongoing investigation, Sycamore Networks strongly recommends that our customers follow the solutions outlined by CERT which are available via the link provided above. Sycamore Networks has always advised that its SNMP-enabled products be deployed only in private networks within the confines of a suitable firewall or proxy server and not directly on the public Internet.

For ingress filtering purposes, Sycamore Networks implementations solely utilize standard SNMP (UDP) Ports 161 and 162. Furthermore, SNMP-bound traffic should only be accepted from known and trusted sources since the agent binds to all the IP addresses on the device including all-ones and directed broadcast addresses.

Sycamore Networks has always considered the security and reliability of our customers' networks of paramount importance and a hallmark of our joint success. If you have any further questions or concerns regarding this matter, please feel free to contact our Customer Service representatives at 800-337-4374.

Top of Page