|
Cisco Optical Networking System 15000 Series Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA19553
|
|
|
Release Date:
|
2006-04-06
|
|
Last Update:
|
2006-07-20
|
|
Popularity:
|
9,175 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Cisco ONS 15000 Series
|
|
| Software: | Cisco Transport Controller 4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-1670
CVE-2006-1671
CVE-2006-1672
|
|
Description:
Some vulnerabilities have been reported in Cisco Optical Networking System 15000 Series, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable management system.
1) Multiple services are vulnerable to ACK DoS attacks where an invalid response is sent instead of the final ACK packet during the 3-way handshake. This can be exploited to cause the control cards to exhaust memory resources, not respond to further connections, or reset by establishing multiple of these connections.
Successful exploitation requires that IP is configured on the LAN interface (enabled by default).
2) An error within the processing of IP packets can be exploited to reset the control cards by sending a specially crafted IP packet.
Successful exploitation requires that IP is configured on the LAN interface (enabled by default) and secure mode for element management system (EMS)-to-network-element access is enabled (disabled by default).
3) Another error within the processing of IP packets can be exploited to reset the control cards by sending a specially crafted IP packet.
Successful exploitation requires that IP is configured on the LAN interface (enabled by default).
4) An error within the processing of OSPF (Open Shortest Path First) packets can be exploited to reset the control cards by sending a specially crafted OSPF packet.
Successful exploitation requires that the OSPF routing protocol is configured on the LAN interface (disabled by default).
Successful exploitation of the above vulnerabilities (#1 through #4) requires that the Optical node has the Common Control Card connected to a DCN (Data Communication Network) and is enabled for IPv4.
The above vulnerabilities (#1 through #4) affect the following Cisco ONS 15000 series platforms:
* Cisco ONS 15310-CL Series
* Cisco ONS 15327 Series
* Cisco ONS 15454 MSPP
* Cisco ONS 15454 MSTP
* Cisco ONS 15600 Series
The following Cisco ONS 15000 series platforms are not affected by the vulnerabilities:
* Cisco ONS 15100 Series
* Cisco ONS 15200 Series
* Cisco ONS 15302, ONS 15305, and ONS 15310-MA platforms
* Cisco ONS 15500 Series
* Cisco ONS 15800 Series
5) A vulnerability exists within the Cisco Transport Controller (CTC) applet launcher, which is downloaded each time a management connection is made to the Optical node. The vulnerability is caused due to the java.policy permissions being to broad by granting all permissions to any software originating from the codeBase or source at http://*/fs/LAUNCHER.jar.
This can be exploited to execute arbitrary code on the CTC workstation if it is used to connect to a malicious web site running Java code from the "/fs/LAUNCHER.jar" location.
The vulnerability affects versions 4.0.x and prior.
Solution:
1-4) Updated versions are available (see patch matrix in vendor advisory).
5) Update to Cisco Transport Controller version 4.1.0 or later.
Provided and/or discovered by:
Reported by vendor.
Changelog:
2006-07-20: Added CVE references.
Original Advisory:
http://www.cisco.com/warp/public/707/cisco-sa-20060405-ons.shtml
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
