What is CVE-1999-0517?

CVE-1999-0517 is a high-severity vulnerability affecting systems with Simple Network Management Protocol (SNMP) community names that are default, null, or missing. This vulnerability can lead to unauthorized access to sensitive information, such as shares, usernames, and the status of running services. The issue impacts a variety of systems, including those running on Microsoft Windows and HP-UX platforms. To protect against this vulnerability, it is crucial to ensure SNMP community names are properly configured and not easily accessible.

Who is impacted by this?

This issue impacts a variety of systems, including HP-UX 10 and 11.00, Sun SunOS 5.0, Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows 2003 Server. Users of these systems should be aware of the potential risks associated with this vulnerability.

What to do if CVE-1999-0517 affected you

If you're affected by the CVE-1999-0517 vulnerability, it's essential to take action to secure your system. Follow these simple steps to mitigate the issue:

1. Remove the SNMP Service if it's not required.

2. If SNMP is needed, secure the SNMP community names using the Registry Editor and the control panel.

3. Edit the registry to restrict access to the SNMP Community Name to approved users only.

4. Configure Windows SNMP security settings in the control panel.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-1999-0517 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue, known as "SNMP community name is world readable by default," was first reported on March 1, 1997. To mitigate the vulnerability, it's recommended to remove the SNMP Service if not required or change the permissions on the ValidCommunities registry key and configure SNMP security settings in the Control Panel.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as NVD-CWE-Other, indicating that the SNMP community name is the default, null, or missing, leading to unauthorized access.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• IBM X-Force Exchange

• CVE Record | CVE