Sign-up

ID

VAR-200112-0223


CVE

CVE-2001-1484


TITLE

Alcatel ADSL modems grant unauthenticated TFTP access via Bounce Attacks

Trust: 0.8

sources: CERT/CC: VU#211736

DESCRIPTION

Alcatel ADSL modems allow remote attackers to access the Trivial File Transfer Protocol (TFTP) to modify firmware and configuration via a bounce attack from a system on the local area network (LAN) side, which is allowed to access TFTP without authentication. The San Diego Supercomputer Center (SDSC) has recently discovered several vulnerabilities in the Alcatel Speed Touch line of Asymmetric Digital Subscriber Line (ADSL) modems. These vulnerabilities are the result of weak authentication and access control policies and result in one or more of the following impacts: unauthorized access, unauthorized monitoring, information leakage, denial of service, and permanent disability of affected devices.The SDSC has published additional information regarding these vulnerabilities at http://security.sdsc.edu/self-help/alcatel/. The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service. Adsl Modem 1000 is prone to a remote security vulnerability. If numerous requests are made for MS DOS device names, ncgihttp.exe inappropriately handles them, resulting in the exhaustion of system resources. Alcatel ADSL modems are vulnerable. The vulnerability allows unauthenticated access to TFTP

Trust: 3.69

sources: NVD: CVE-2001-1484 // CERT/CC: VU#211736 // CERT/CC: VU#890128 // CERT/CC: VU#642760 // BID: 89747 // BID: 2575 // VULHUB: VHN-4288

AFFECTED PRODUCTS

vendor:lotusmodel: - scope: - version: -

Trust: 1.6

vendor:alcatelmodel:speed touch adsl modemscope:eqversion:home

Trust: 1.6

vendor:alcatelmodel:adsl modem 1000scope:eqversion:*

Trust: 1.0

vendor:alcatelmodel: - scope: - version: -

Trust: 0.8

vendor:alcatelmodel:adsl modem 1000scope: - version: -

Trust: 0.6

vendor:alcatelmodel:speed touch adsl modem homescope: - version: -

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.6

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.5

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.4

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.3

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.2

Trust: 0.3

vendor:lotusmodel:dominoscope:eqversion:5.0.1

Trust: 0.3

vendor:lotusmodel:dominoscope:neversion:5.0.7

Trust: 0.3

sources: CERT/CC: VU#211736 // CERT/CC: VU#890128 // CERT/CC: VU#642760 // BID: 89747 // BID: 2575 // CNNVD: CNNVD-200112-195 // NVD: CVE-2001-1484

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2001-1484
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#211736
value: 27.56

Trust: 0.8

CARNEGIE MELLON: VU#890128
value: 5.07

Trust: 0.8

CARNEGIE MELLON: VU#642760
value: 10.50

Trust: 0.8

CNNVD: CNNVD-200112-195
value: HIGH

Trust: 0.6

VULHUB: VHN-4288
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2001-1484
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-4288
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#211736 // CERT/CC: VU#890128 // CERT/CC: VU#642760 // VULHUB: VHN-4288 // CNNVD: CNNVD-200112-195 // NVD: CVE-2001-1484

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2001-1484

THREAT TYPE

network

Trust: 0.6

sources: BID: 89747 // BID: 2575

TYPE

unknown

Trust: 0.6

sources: CNNVD: CNNVD-200112-195

EXTERNAL IDS

db:CERT/CCid:VU#211736

Trust: 2.8

db:NVDid:CVE-2001-1484

Trust: 2.0

db:BIDid:2575

Trust: 1.1

db:XFid:6336

Trust: 0.9

db:XFid:6348

Trust: 0.8

db:CERT/CCid:VU#890128

Trust: 0.8

db:BIDid:2598

Trust: 0.8

db:XFid:6351

Trust: 0.8

db:CERT/CCid:VU#642760

Trust: 0.8

db:CNNVDid:CNNVD-200112-195

Trust: 0.7

db:CERT/CCid:CA-2001-08

Trust: 0.6

db:BIDid:89747

Trust: 0.4

db:VULHUBid:VHN-4288

Trust: 0.1

sources: CERT/CC: VU#211736 // CERT/CC: VU#890128 // CERT/CC: VU#642760 // VULHUB: VHN-4288 // BID: 89747 // BID: 2575 // CNNVD: CNNVD-200112-195 // NVD: CVE-2001-1484

REFERENCES

url:http://www.cert.org/advisories/ca-2001-08.html

Trust: 3.0

url:http://www.kb.cert.org/vuls/id/211736

Trust: 3.0

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/6336

Trust: 2.1

url:http://www.securityfocus.com/advisories/3208

Trust: 1.6

url:http://xforce.iss.net/xforce/xfdb/6336

Trust: 0.9

url:http://security.sdsc.edu/self-help/alcatel/

Trust: 0.8

url:http://www.alcatel.com/consumer/dsl/security.htm

Trust: 0.8

url:http://www.securityfocus.com/bid/2575

Trust: 0.8

url:http://xforce.iss.net/static/6348.php

Trust: 0.8

url:http://www.securityfocus.com/bid/2598

Trust: 0.8

url:http://xforce.iss.net/static/6351.php

Trust: 0.8

url:http://www.notes.net/r5fixlist.nsf/a8f0ffda1fc76c8985256752006aba6c?openview&start=3.111&count=30&expand=3.126#3.126

Trust: 0.8

url:http://www.lotus.com/home.nsf/welcome/domino

Trust: 0.3

sources: CERT/CC: VU#211736 // CERT/CC: VU#890128 // CERT/CC: VU#642760 // VULHUB: VHN-4288 // BID: 89747 // BID: 2575 // CNNVD: CNNVD-200112-195 // NVD: CVE-2001-1484

CREDITS

Unknown

Trust: 0.3

sources: BID: 89747

SOURCES

db:CERT/CCid:VU#211736
db:CERT/CCid:VU#890128
db:CERT/CCid:VU#642760
db:VULHUBid:VHN-4288
db:BIDid:89747
db:BIDid:2575
db:CNNVDid:CNNVD-200112-195
db:NVDid:CVE-2001-1484

LAST UPDATE DATE

2025-01-14T19:55:43.738000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#211736date:2001-04-11T00:00:00
db:CERT/CCid:VU#890128date:2001-07-12T00:00:00
db:CERT/CCid:VU#642760date:2001-07-17T00:00:00
db:VULHUBid:VHN-4288date:2017-07-11T00:00:00
db:BIDid:89747date:2001-12-31T00:00:00
db:BIDid:2575date:2001-04-11T00:00:00
db:CNNVDid:CNNVD-200112-195date:2005-10-20T00:00:00
db:NVDid:CVE-2001-1484date:2024-11-20T23:37:48.280

SOURCES RELEASE DATE

db:CERT/CCid:VU#211736date:2001-04-10T00:00:00
db:CERT/CCid:VU#890128date:2001-07-12T00:00:00
db:CERT/CCid:VU#642760date:2001-07-12T00:00:00
db:VULHUBid:VHN-4288date:2001-12-31T00:00:00
db:BIDid:89747date:2001-12-31T00:00:00
db:BIDid:2575date:2001-04-11T00:00:00
db:CNNVDid:CNNVD-200112-195date:2001-12-31T00:00:00
db:NVDid:CVE-2001-1484date:2001-12-31T05:00:00