Sign-up

ID

VAR-200001-0041


CVE

CVE-2000-0064


TITLE

Nortel Contivity Switch Remote Denial of Service Attack and File Leak Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2001-0323

DESCRIPTION

cgiproc CGI script in Nortel Contivity HTTP server allows remote attackers to cause a denial of service via a malformed URL that includes shell metacharacters. The Contivity series is an external network switch product developed by Nortel. The newer Contivity switch includes an httpd server running on the VxWorks operating system to provide a remote Web-based management interface.  A vulnerability exists in the "cgiproc" script implementation of the Web management interface of the Contivity series switches. A remote attacker could use this vulnerability to conduct a denial of service attack on the switch or view arbitrary system files.  Because the user input is not sufficiently filtered, if you pass metacharacters to the cgiporc program, such as "!" Or "$", the system will crash. Another vulnerability of cgiproc is the lack of authentication when requesting a management page. This enables an attacker to view any file in the web server. A total system crash can occur as a result of exploiting a vulnerability in a cgi-bin program called "cgiproc" that is included with the webserver. If metacharacters such as "!", or "$" are passed to cgiproc, the system will crash (because the characters are not escaped). foo <foo@blacklisted.intranova.net> provided the following example: http://x.x.x.x/manage/cgi/cgiproc?$ [crash] No evidence of this problem being exploited is saved in the logs. foo <foo@blacklisted.intranova.net> also provided an example for this vulnerability: http://x.x.x.x/manage/cgi/cgiproc?Nocfile=/name/and/path/of/file. (interesting places to look: /system/filelist.dat, /system/version.dat, /system/keys, /system/core, etc.) All that is written to the logs when this is exploited is below: 09:44:23 tEvtLgMgr 0 : Security [12] Management: Request for cgiproc denied. requires login In order to perform the operations detailed in the report, the "attackers" must be internal, private side users or authenticated tunnel users and the site administrator must allow them HTTP as a management protocol

Trust: 1.8

sources: NVD: CVE-2000-0064 // CNVD: CNVD-2001-0323 // BID: 938 // VULHUB: VHN-1643

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2001-0323

AFFECTED PRODUCTS

vendor:nortelmodel:contivityscope:eqversion:1.0

Trust: 1.6

vendor:nonemodel: - scope: - version: -

Trust: 0.6

vendor:nortelmodel:networks contivity extranet switchscope:eqversion:2500

Trust: 0.3

sources: CNVD: CNVD-2001-0323 // BID: 938 // CNNVD: CNNVD-200001-041 // NVD: CVE-2000-0064

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2000-0064
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200001-041
value: MEDIUM

Trust: 0.6

VULHUB: VHN-1643
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2000-0064
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-1643
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-1643 // CNNVD: CNNVD-200001-041 // NVD: CVE-2000-0064

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2000-0064

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200001-041

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200001-041

EXTERNAL IDS

db:NVDid:CVE-2000-0064

Trust: 2.3

db:BIDid:938

Trust: 2.0

db:OSVDBid:7583

Trust: 1.7

db:CNNVDid:CNNVD-200001-041

Trust: 0.7

db:CNVDid:CNVD-2001-0323

Trust: 0.6

db:NSFOCUSid:257

Trust: 0.6

db:VULHUBid:VHN-1643

Trust: 0.1

sources: CNVD: CNVD-2001-0323 // VULHUB: VHN-1643 // BID: 938 // CNNVD: CNNVD-200001-041 // NVD: CVE-2000-0064

REFERENCES

url:http://www.securityfocus.com/bid/938

Trust: 1.7

url:http://www.osvdb.org/7583

Trust: 1.7

url:http://www.nsfocus.net/vulndb/257

Trust: 0.6

url:http://www.nortelnetworks.com/products/01/contivity/index.html

Trust: 0.3

url: -

Trust: 0.1

sources: VULHUB: VHN-1643 // BID: 938 // CNNVD: CNNVD-200001-041 // NVD: CVE-2000-0064

CREDITS

foo foo@blacklisted.intranova.net

Trust: 0.6

sources: CNNVD: CNNVD-200001-041

SOURCES

db:CNVDid:CNVD-2001-0323
db:VULHUBid:VHN-1643
db:BIDid:938
db:CNNVDid:CNNVD-200001-041
db:NVDid:CVE-2000-0064

LAST UPDATE DATE

2024-08-14T13:40:49.660000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2001-0323date:2001-01-19T00:00:00
db:VULHUBid:VHN-1643date:2008-09-10T00:00:00
db:BIDid:938date:2000-01-18T00:00:00
db:CNNVDid:CNNVD-200001-041date:2006-08-30T00:00:00
db:NVDid:CVE-2000-0064date:2008-09-10T19:02:41.993

SOURCES RELEASE DATE

db:CNVDid:CNVD-2001-0323date:2001-01-19T00:00:00
db:VULHUBid:VHN-1643date:2000-01-17T00:00:00
db:BIDid:938date:2000-01-18T00:00:00
db:CNNVDid:CNNVD-200001-041date:2000-01-17T00:00:00
db:NVDid:CVE-2000-0064date:2000-01-17T05:00:00