Details of VAR-200411-0076

ID

VAR-200411-0076

CVE

CVE-2004-0308

TITLE

Cisco Systems optical networking systems software Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2004-000941

DESCRIPTION

Unknown vulnerability in Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS15600 before 1.3(0) allows a superuser whose account is locked out, disabled, or suspended to gain unauthorized access via a Telnet connection to the VxWorks shell. Cisco Systems optical networking systems software Exists in unspecified vulnerabilities.None. It should be noted that the various ONS platforms are intended to be deployed on networks that are physically separated from the Internet, so exposure to these issues by remote attackers is limited. Cisco ONS is an optical network platform developed by CISCO. Cisco ONS 15327, ONS 15454, ONS 15454 SDH, and ONS 15600 can be managed by XTC, TCC+/TCC2, TCCi/TCC2, and TSC control cards. These control cards are generally isolated from the Internet and only connected to the local network environment. There are the following vulnerabilities: - CSCec17308/CSCec19124(tftp) The TFTP service uses UDP port 69 by default, allowing GET and PUT commands without any authentication, and the client can connect to the fiber optic device and upload and download arbitrary user data. - CSCec17406(port 1080) Cisco ONS 15327, ONS 15454 and ONS 15454 SDH hardware has an ACK denial of service attack on TCP port 1080, which is used for network management to communicate with the control card. Through ACK denial of service attack, the control card on the fiber optic equipment can be reset. - CSCec66884/CSCec71157(SU access) By default, only superusers are allowed to have telnet access to the VxWorks operating system. Due to this vulnerability, if the superuser account is banned, locked and suspended, you can still log in to the VxWorks shell with the set password

Trust: 1.98

sources: NVD: CVE-2004-0308 // JVNDB: JVNDB-2004-000941 // BID: 9699 // VULHUB: VHN-8738

AFFECTED PRODUCTS

vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.1\(2\)	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.0\(1\)	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.0\(2\)	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.5	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	1.0	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.1\(0\)	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.0.0	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.1\(1\)	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.1.0	Trust: 1.0
vendor:	cisco	model:	optical networking systems software	scope:	eq	version:	4.1\(3\)	Trust: 1.0
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.5	Trust: 0.9
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.0	Trust: 0.9
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.1(2)	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.0.0	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.1(0)	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	1.0	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.1(1)	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.5	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.0(2)	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.1.0	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.0(1)	Trust: 0.8
vendor:	シスコシステムズ	model:	optical networking systems software	scope:	eq	version:	4.1(3)	Trust: 0.8
vendor:	cisco	model:	ons 15454 optical transport platform	scope:	eq	version:	4.1\(1\)	Trust: 0.6
vendor:	cisco	model:	ons 15454 optical transport platform	scope:	eq	version:	4.1\(0\)	Trust: 0.6
vendor:	cisco	model:	ons 15454 optical transport platform	scope:	eq	version:	4.1\(2\)	Trust: 0.6
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1\(1\)	Trust: 0.6
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1\(0\)	Trust: 0.6
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1\(2\)	Trust: 0.6
vendor:	cisco	model:	ons 15600	scope:	eq	version:	1.0	Trust: 0.6
vendor:	cisco	model:	ons 15454 optical transport platform	scope:	eq	version:	4.1\(3\)	Trust: 0.6
vendor:	cisco	model:	ons	scope:	eq	version:	156001.0	Trust: 0.3
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1(2)	Trust: 0.3
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1(1)	Trust: 0.3
vendor:	cisco	model:	ons 15454sdh	scope:	eq	version:	4.1(0)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.1(3)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.1(2)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.1(1)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.1(0)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.1	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.0(1)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	eq	version:	154544.0	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.1(2)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.1(1)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.1(0)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.0(2)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.0(1)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	eq	version:	153274.0	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	156001.3(0)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	156001.1(1)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	156001.1(0)	Trust: 0.3
vendor:	cisco	model:	ons 15454sdh	scope:	ne	version:	4.6(1)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	ne	version:	154544.1(3)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	ne	version:	154544.1(1)	Trust: 0.3
vendor:	cisco	model:	ons optical transport platform	scope:	ne	version:	154544.0(2)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	153274.1(3)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	153274.1(1)	Trust: 0.3
vendor:	cisco	model:	ons	scope:	ne	version:	153274.0(2)	Trust: 0.3

sources: BID: 9699 // JVNDB: JVNDB-2004-000941 // CNNVD: CNNVD-200411-171 // NVD: CVE-2004-0308

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2004-0308
value:	HIGH
Trust: 1.0
NVD:	CVE-2004-0308
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200411-171
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-8738
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2004-0308
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-8738
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-8738 // JVNDB: JVNDB-2004-000941 // CNNVD: CNNVD-200411-171 // NVD: CVE-2004-0308

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	others (CWE-Other) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2004-000941 // NVD: CVE-2004-0308

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200411-171

TYPE

Unknown

Trust: 0.9

sources: BID: 9699 // CNNVD: CNNVD-200411-171

PATCH

title:

Cisco ONS 15327

url:

https://www.cisco.com/web/JP/product/hs/optical/ons15327/prodlit/pdf/0261_on15327.pdf

Trust: 0.8

sources: JVNDB: JVNDB-2004-000941

EXTERNAL IDS

db:	NVD	id:	CVE-2004-0308	Trust: 3.6
db:	BID	id:	9699	Trust: 2.8
db:	OSVDB	id:	4010	Trust: 1.7
db:	JVNDB	id:	JVNDB-2004-000941	Trust: 0.8
db:	CNNVD	id:	CNNVD-200411-171	Trust: 0.7
db:	XF	id:	15266	Trust: 0.6
db:	CISCO	id:	20040219 CISCO ONS 15327, ONS 15454, ONS 15454 SDH, AND ONS 15600 VULNERABILITIES	Trust: 0.6
db:	VULHUB	id:	VHN-8738	Trust: 0.1

sources: VULHUB: VHN-8738 // BID: 9699 // JVNDB: JVNDB-2004-000941 // CNNVD: CNNVD-200411-171 // NVD: CVE-2004-0308

REFERENCES

url:	http://www.cisco.com/warp/public/707/cisco-sa-20040219-ons.shtml	Trust: 2.8
url:	http://www.securityfocus.com/bid/9699	Trust: 2.5
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/15266	Trust: 1.9
url:	http://www.osvdb.org/4010	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2004-0308	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/15266	Trust: 0.6

sources: VULHUB: VHN-8738 // BID: 9699 // JVNDB: JVNDB-2004-000941 // CNNVD: CNNVD-200411-171 // NVD: CVE-2004-0308

CREDITS

Cisco Security Advisory

Trust: 0.6

sources: CNNVD: CNNVD-200411-171

SOURCES

db:	VULHUB	id:	VHN-8738
db:	BID	id:	9699
db:	JVNDB	id:	JVNDB-2004-000941
db:	CNNVD	id:	CNNVD-200411-171
db:	NVD	id:	CVE-2004-0308

LAST UPDATE DATE

2024-08-14T14:08:58.086000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-8738	date:	2018-10-30T00:00:00
db:	BID	id:	9699	date:	2009-07-12T03:06:00
db:	JVNDB	id:	JVNDB-2004-000941	date:	2024-06-07T09:02:00
db:	CNNVD	id:	CNNVD-200411-171	date:	2006-01-30T00:00:00
db:	NVD	id:	CVE-2004-0308	date:	2018-10-30T16:26:17.390

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-8738	date:	2004-11-24T00:00:00
db:	BID	id:	9699	date:	2004-02-19T00:00:00
db:	JVNDB	id:	JVNDB-2004-000941	date:	2024-06-07T00:00:00
db:	CNNVD	id:	CNNVD-200411-171	date:	2004-02-19T00:00:00
db:	NVD	id:	CVE-2004-0308	date:	2004-11-24T05:00:00