Check Point Advisories

Non-SNMP Traffic Over Port 161/162

Vulnerability
Protection

Check Point Reference:	CPAI-2012-076
Date Published:	27 Feb 2012
Severity:	High
Last Updated:	Monday 25 November, 2024
Source:
Protection Provided by:	Security Gateway R75 R71 R70
Who is Vulnerable?	Computer networks
Vulnerability Description	TCP Port 161/162 is normally used to transfer SNMP traffic. Non-SNMP traffic over this port may be used for malicious purposes.
Vulnerability Details	Many applications scan for open SNMP ports for malicious purposes. Non-SNMP traffic over port 161/162 may indicate an attempt to pass malicious traffic to or outside the network.

Protection Overview

This protection will detect and block non-SNMP traffic over port 161/162.

In order for the protection to be activated, update your product to the latest update. For information on how to update , go to SBP-2006-05, Protection tab and select the version of your choice.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Non-SNMP Traffic Over Port 161/162 protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: SNMP Protection Violation
Attack Information: Non-SNMP traffic over port 161/162