Cisco ONS 15000 Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA10933
VERIFY ADVISORY:
http://secunia.com/advisories/10933/
CRITICAL:
Less critical
IMPACT:
Security Bypass, Exposure of system information, DoS
WHERE:
From local network
OPERATING SYSTEM:
Cisco ONS 15000 Series
DESCRIPTION:
Multiple vulnerabilities have been reported in various products running Cisco ONS, which can be exploited by malicious people to gain knowledge of system information, cause a DoS (Denial of Service), or gain unauthorised access.
- The TFTP service (port 69/UDP) accepts by default "GET" and "PUT"
commands without any prior user authentication. This can be exploited to gain knowledge of information in ONS system files or crash the device by uploading corrupted ONS system files.
- An error in the network management applications' connection handling can be exploited to cause a control card to reboot. This can be achieved by not sending the final ACK packet when establishing a connection to port 1080/TCP but instead sending an invalid response.
- Superusers can by default gain a VxWorks shell by logging in via the Telnet service even though their account has been locked out, disabled, or suspended.
See following link for a list of affected products:
http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml#affected
SOLUTION:
The following patch matrix contains information about released
fixes:
http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml#software
PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml
For further details and links please click here to see the actual Secunia Advisory: http://secunia.com/advisories/10933/