CVE-2000-1159: NAI Sniffer Agent allows remote attackers to gain privileges on the agent by sniffing the initial UDP authe...

Security readout for executives and security teams

An older Network Associates (NAI) Sniffer Agent product accepts management commands over the network without proving who is really sending them. An attacker who can watch traffic on the same network can capture the initial login exchange, then impersonate an administrator and issue commands to the sniffer. In plain terms, a network monitoring tool intended to help defenders could be quietly taken over by anyone with access to the wire. Exposure is limited to environments still running the legacy NAI/Network Associates Distributed Sniffer Agent from around 2000. No specific versions or CPEs are enumerated in the source bundle. Any deployment that persists today is almost certainly on unsupported hardware or virtualized legacy segments, likely in industrial, lab, or archival networks. Low priority for most organizations unless legacy NAI sniffer agents are still in production. If any remain, treat as an accelerated decommissioning item rather than an emergency patch, and confirm they are not exposed to untrusted networks. Mitigation focus: Inventory any remaining NAI or Network Associates Distributed Sniffer Agent deployments and plan decommissioning.; Isolate legacy sniffer management traffic on a dedicated, access-controlled VLAN or out-of-band network.; Restrict UDP management ports to known administrator hosts via firewall or ACL..

Prepared

Jul 12, 2026, 00:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.