Attackers may use this hidden community from remote to gain information otherwise reserved for authorized users. Attackers can also use this community to disrupt collection of data over SNMP as well as sever communication between Collection Agents and Management stations. X-Force has discovered a serious vulnerability in Sun Microsystems Solstice Enterprise Agent and the Solaris operating system. This vulnerability allows attackers to execute arbitrary commands with root privileges, manipulate system parameters and kill processes. X-Force has discovered that this vulnerability is present on the Solaris Operating System version 2.6.
Earlier versions are vulnerable.
Solaris 2.7 beta is also not vulnerable. Solaris 5.6 Many administrators have no need for host based SNMP agents. A hidden and undocumented community string is present in the SNMP subagent which may allow remote attackers change most system parameters. Remote attackers may kill any process, update routes, potentially sidestep firewalls or disable network interfaces. Most notably, attackers may indirectly execute arbitrary commands with superuser privileges.