Printer search via SNMP is reported as a problem
Yes, I know SNMP v1/v2 is insecure. However, almost everybody has some printers installed. Both Windows and Linux default to query the installed network printers via SNMP to get their status or ink levels. For each configured printer on my PC, I get a snort problem notification:
2022-11-22 01:21:05 info snort[26943]: 'Security alert from host 64:51:06:02:XX:XX to 10.0.0.5:161 - "PROTOCOL-SNMP public access udp"'
2022-11-22 01:21:05 info snort[26943]: 'Security alert from host 64:51:06:02:XX:XX to 10.0.0.5:161 - "PROTOCOL-SNMP request udp"'
I don't think this is useful. Can you somehow disable these rules?
One of the matching rules is:
alert udp $EXTERNAL_NET any -> $HOME_NET 161 ( msg:"PROTOCOL-SNMP public access udp"; flow:to_server; content:"|06|public"; metadata:policy max-detect-ips drop,ruleset community; service:snmp; reference:bugtraq,2112; reference:bugtraq,4088; reference:bugtraq,4089; reference:cve,1999-0517; reference:cve,2002-0012; reference:cve,2002- 0013; reference:cve,2022-20918; reference:url,tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmcsfr-snmp-access-6gqgtJ4S; classtype:attempted- recon; gid:1; sid:1411; rev:21; )
Edited by Martin Pecka