 In addition, SNMP was successfully "sold" by the Internet Engineering Task Force (IETF) as the chief Internet standard for network management. The IETF is influential in the Internet engineering and telecom communities. In the early days of SNMP, developing applications based on SNMP required significant effort to manage the variety of networked devices in use. This problem faded away as more development and other tools became available to support SNMP. SNMP is now the dominant communications protocol for end-to-end management of inter- networking devices. SNMP facilitates communication between a managed device and the user of an SNMP management application. A managed device is any device with an SNMP agent. The SNMP agent is stored on a managed device. The agent gives access to data, or managed objects, that describe the state of a managed device. Through this access, the SNMP manager or management application can monitor and control the device. K. Misra et al. (eds.), OSS for Telecom Networks © Springer-Verlag London Limited 2004 OSS for Telecom Networks The Oulu University Secure Programming Group of Finland has found several vulnerabilities in the decoding and processing of SNMP trap messages and SNMP request messages by SNMP managers. There are vulnerabilities in the decoding and the subsequent processing of SNMP trap messages and SNMP request messages.' Vulnerabilities include denial-of-service conditions, format string vulnerabilities and buffer overflows. These may in turn result in service interruptions and may allow an attacker to gain access to the affected device. Owing to slight differences in SNMP implementations, the specific outcome arising from the vulnerabilities varies from product to product. The development of the second version of SNMP (SNMPv2) standard addresses the lack of security of SNMP using mechanisms which focus on privacy, authentica- tion and access control. SNMPv2 also allows more complex specification of vari- ables and has some management commands not available in SNMP. SNMPv2 