Certain implementations of SNMPv3 have a minor deficiency in the way HMAC authentication is performed. This can lead to isolated cases of spoofed SNMPv3 authentication. This issue is tracked in TIC.14989 and TIC.14990 for C-series Session and Resource Control appliances running SRC. US-CERT has assigned VU#878044 to track this vulnerability. No other Juniper Networks products are affected by this vulnerability.
The code has been modified to properly perform HMAC authentication. These modifications eliminate this method of being erroneously authenticated to the device.
Customers running SRC 1.0.0, 1.0.1, or 2.0.0 should contact Juniper Networks Customer Support to obtain updated versions of the software for the C-series platform. Customers utilizing a C-series Session and Resource Control appliance should upgrade their software to a release dated after June 13, 2008.
Workarounds: There are several mitigation techniques available to avoid this authentication vulnerability:
Disclaimer: Juniper Networks is providing this notice on an "AS IS" basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. Juniper Networks expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of noninfringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. Juniper Networks may change this notice at any time.