SNMP Query Routing Information Disclosure

#TRUSTED 9189f51fc7c21dbfe8ff23d6433b2d03f7ca26dc3420702aec8c63e7fb661936e777cd3a8ec5512833d35d1b502ef73867e20ef813087473528418f5f26307fb8993e78ff8b457a0fd7aaff3a5e13382c55cbbf502c9ecd4c05ab17174b4a13dabd9047e62332fa7175006a43394e99b69863b58ff2e407490e08e283280caee9d01ac1c9fe30ced173d29c9825aa679ac91c73781691896a50e9bbb023b92782d9a439e56cfb40ab3b3fc494b9f7bf9a79b7b1e06b38b95f063f1741aa100d658e64867b1817bfad626a8c41fa36d17db83ec2b5f58586e42cee0d84a0aa789e0e93e9da466528b0ad89620abe521763f2e7cfac13879b4961768dfa6a564c8d8a3b5ddc4012d10a8b24b44b67a2bb9cd87e63a6a5dfc69fd32c3f58caee4974f22e289810b0a6b8c2e54c6b6223da95f6e42a54e10b50bd80602f7fb9738fc7637d64f67ac99ec18588a921960f4b89c62de4103a021ee4d2e975554119bd0ef98a318bf15a1d1c126a8738734f0f363c0e4ed953bc215376b317b6f3aa29e2b0a3dc4c033efdd808e16165355d8adfc3c54f8577443f59d788da67df124d971945516c7133ef0aa5e4fcec06851e517b46bd63d4fda54923cfb5036bf5700ad6d0c4dee0251ccd810b7759dd179cc6a90e8a0ea5abad6d95dd39583bd55f03f9bbb514db840e32f03a748d896cd5da36ae4134277da256b422565d92d37e4
#TRUST-RSA-SHA256 5c0d3da4354b9b2c66c06e5a041cd247a3bf2b83472c3d57532fde3c1bc0c29723a2c2f58d30510483199eb201d394ab35c0ec2137cedd8dacd04b46375476cb27a9039deddb477992493c190455fabf49927203459062f520e0d521f153dbe528df10a43e04de0ff091441780e525c45306a1cbc652990029136cf5112fdbcd01a0f69028919a81a560ee40f385c132634dc6213d6e51512d4df6052ad8ffead3193c9e0b18579fe94c9e2aadf073b8a743f64485fe18f6205539521cd76dfdd708b6ee737aa5fd27269ba305da25344f5d145742150824decc1578645235f5b0aee320906d86060271e202497a2e8fe62a6e32ce1d0677c530c2511d58de8d8bec338e85322cd26beb33cabe37ab8a155583f7e20fa4a8ef723753659607c6e076793ff6cdd0ea14db864bd6a0b90807796f2577670f96819f625c6dca1b9fe342a2cf8087a791a536f643b12631c5e44267b8bb231aff3b6316b48c27d5147f6710d8444ed73b54df5b13d302068df5301bee42b9ca0508cc5964a1e5fcde5c010e4e8b1f17878a0ed854be7ab8625a77b7cc908f11174e75c200a917af177689cc932561983dc4f799f3c08c88ea85b96f41682512a05d3b2da92622dad966d000605578192c63c3fb51f6719f08590ab514bad06c5be7bd650e319bc8acbed182bc9e63343cd0672268a2344bfada55db5988bbd049dd67753ae5b60dfd
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if(description)
{
 script_id(34022);
 script_version("1.13");
 script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/17");

 script_name(english: "SNMP Query Routing Information Disclosure");
 
 script_set_attribute(attribute:"synopsis", value:
"The list of IP routes on the remote host can be obtained via SNMP." );
 script_set_attribute(attribute:"description", value:
"It is possible to obtain the routing information on the remote host
by sending SNMP requests with the OID 1.3.6.1.2.1.4.21

An attacker may use this information to gain more knowledge about the
network topology." );
 script_set_attribute(attribute:"solution", value:
"Disable the SNMP service on the remote host if you do not use it, or
filter incoming UDP packets going to this port." );
 script_set_attribute(attribute:"risk_factor", value:"None" );
 script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/21");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();

 
 script_summary(english: "Enumerates routes via SNMP");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2008-2026 Tenable Network Security, Inc.");
 script_family(english: "SNMP");
 script_dependencies("snmp_settings.nasl", "find_service2.nasl");
 script_require_keys("SNMP/community");
 exit(0);
}

#

include ("snmp_func.inc");
include ("misc_func.inc");

community = get_kb_item("SNMP/community");
if(!community)exit(0);

port = get_kb_item("SNMP/port");
if(!port)port = 161;

if (! get_udp_port_state(port))
  audit(AUDIT_PORT_CLOSED, port, 'udp');

var soc = open_sock_udp(port);
if (!soc)
  audit(AUDIT_SOCK_FAIL, port, "UDP");

ipRouteInfo = make_list();
ri = 0;

# ipRouteInfo
roid = "1.3.6.1.2.1.4.21.1.1"; 
oid = roid;
while (1)
{
  v = snmp_request_next(socket: soc, community: community, oid: oid);
  if (isnull(v) || ! issameoid(origoid: roid, oid: v[0])) break;
  oid = v[0];
  ipRouteInfo[ri++] = v[1];
}

if (ri == 0 || ri == 1 && ipRouteInfo[0] == "0.0.0.0")
  audit(AUDIT_LISTEN_NOT_VULN, 'SMTP server', port);

ipRouteMask = make_list();
mi = 0;
# ipRouteMask
roid = "1.3.6.1.2.1.4.21.1.11";
oid = roid;
var report = NULL;

while (1)
{
  v = snmp_request_next(socket: soc, community: community, oid: oid);
  if (isnull(v) || ! issameoid(origoid: roid, oid: v[0])) break;
  oid = v[0];
  ipRouteMask[mi++] = v[1];
  report = '\n'; # setting rather than creating a flag var
}

if (!empty_or_null(report))
{
  for (i = 0; i < mi || i < ri; i ++)
    if (ipRouteInfo[i] != '0.0.0.0' || ipRouteMask[i] != '0.0.0.0')
      report = strcat(report, ipRouteInfo[i], '/', ipRouteMask[i], '\n');
  
  security_note(port: port, proto: 'udp', extra: report);
}
else audit(AUDIT_LISTEN_NOT_VULN, 'SMTP server', port);