Eurotech Support Forums - SNMP Vulnerability (CVE-2006-5583) in CE 4.2

All Forums

Microsoft Windows CE

General CE

SNMP Vulnerability (CVE-2006-5583) in CE 4.2

Forum Locked

Send Topic to a Friend

Printer Friendly

Author

Topic

padrino121

8 Posts

Posted - 18 Aug 2008 : 08:35:52

I have an old project that is finally starting to stand up and although hardware changes from the BitsyX are not possible I am doing a software refresh since it has been years since the boards have seen a new load.

One of the findings I need to correct is the SNMP Vulnerability from 2006 (CVE-2006-5583) because it seems the CE 4.2.14 build currently deployed is affected.

I see notes in the newer builds from time to time regarding QFEs being applied but nothing past the date the vulnerability was published so if anyone knows what build of 4.2 corrected this issue please confirm.

grenierm

133 Posts

Posted - 18 Aug 2008 : 17:56:20

Hi, thanks for the question.

We are not currently diong new development on the BitsyX.

Feel free to drop our Eurotech Sales Team a line a sales.us@eurotech.com to discuss possible development with the BitsyX or a potential transition to the BitsyXb.

padrino121

8 Posts

Posted - 18 Aug 2008 : 21:47:37

Thanks for the reply..

I didn't mean to imply I was looking for new development with the BitsyX, rather clarification on the 4.2 builds posted through April of 2007 (4.20.46) since they were delivered a few months after the fix should have been provided by Microsoft. If anyone has information regarding the fixes in the later CE builds, specifically the SNMP vulnerability that will allow me to move forward.

Thanks for any help that can be provided.

akidder

1519 Posts

Posted - 19 Aug 2008 : 16:11:28

As luck would have it, we've just completed a maintenance build for another customer. You spotted that we just posted build 4.20.52 today. Feel free to use it.

We'll take a look at the history of the build machines to determine if the specific QFEs have been applied.

akidder

1519 Posts

Posted - 19 Aug 2008 : 17:32:28

We took a look at the QFE descriptions, but none seem to mention this specific vulnerability. It's not clear if it was an issue and/or if it was resolved.

If this particular item is critical to your application, you might consider running a security analyzer against your product to ensure it can operate securely the network environment in which it's going to be running. You can also enable the firewall to limit the kinds of transactions it will run.

padrino121

8 Posts

Posted - 19 Aug 2008 : 23:21:54

Thanks Andrew..

It's been a very long time since I interfaced with you, it's good to know you're still around.

I'm going to update to 4.20.52 and rerun the scans, I'm disabling anyway but I wanted to close the vulnerability because it's easier to assert compliance through documentation if I can say it's been patched as well as turned off.

Is it possible to get access to the list of QFEs that have been applied since 4.20.14 so I can resolve other potential problems through documentation without manual verification?

Topic

Forum Locked

Send Topic to a Friend

Printer Friendly

Jump To:

Eurotech Support Forums

This page was generated in 0.03 seconds.

Snitz Forums 2000