[NEWS] Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 Nessus Vulnerabilities
From: SecuriTeam (support_at_securiteam.com)
Date: 05/05/03
- Previous message: SecuriTeam: "[NEWS] MDG Web Server 4D Buffer Overflow (GET)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 5 May 2003 18:22:37 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
- - - - - - - - -
Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 Nessus Vulnerabilities
------------------------------------------------------------------------
SUMMARY
Nessus exposes FTP and Telnet vulnerabilities in the Cisco ONS15454
Optical Transport Platform, the Cisco ONS15327 Edge Optical Transport
Platform, the Cisco ONS15454SDH Multiplexer Platform, and the Cisco
ONS15600 Multiservice Switching Platform. Cisco ONS15454 hardware running
ONS Releases 3.0 through Release 3.4.1, Cisco ONS15327 and ONS15454SDH
hardware running ONS Releases 3.3 through Release 3.4.1, and Cisco
ONS15600 hardware running ONS Release 1.0 is affected by these
vulnerabilities. Nessus is a free security scanner software available from
nessus.org.
These vulnerabilities are documented as Cisco Bug IDs CSCdz83515 and
CSCdz83519. There are workarounds available to mitigate the effects of
these vulnerabilities.
DETAILS
Affected Products:
* Cisco ONS15454 hardware running ONS Releases 3.0 through Release 3.4.1
* Cisco ONS15327 and Cisco ONS15454SDH hardware running ONS Releases 3.3
through Release 3.4.1
* Cisco ONS15600 hardware running ONS Release 1.0
Products not affected by these vulnerabilities are listed below.
* Cisco ONS15454 hardware running ONS Releases 4.0 and 2.x
* Cisco ONS15327 hardware running ONS Release 4.0 and Release 1.x
* Cisco ONS15454SDH hardware running ONS Release 4.0
No other Cisco products are currently known to be affected by these
vulnerabilities.
To determine your software revision, view the Help > About window on the
CTC network management software.
Details:
The affected Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 hardware
is managed via the TCC+, XTC, TCCi, and TSC control cards respectively.
These control cards are usually connected to a network isolated from the
Internet and local to the customer's environment. This limits the exposure
to the exploitation of the vulnerabilities from the Internet.
DDTS - Description:
CSCdz83515 - TCC+ reboots on Nessus VxWorks FTP DoS script
Details:
By making an invalid FTP request, a person may cause the TCC+, XTC, TCCi,
or TSC control cards to reset. Repeated invalid requests would cause both
the control cards to be reset at the same time.
DDTS - Description:
CSCdz83519 - TCC+ reboots on Nessus VxWorks binlogin overflow script
Details:
By making an invalid Telnet request, a person may cause the TCC+, XTC,
TCCi, or TSC control cards to reset. Repeated invalid requests would cause
both the control cards to be reset at the same time.
These vulnerabilities are documented as Bug IDs CSCdz83515 and CSCdz83519.
Details can be viewed after 2003 May 02 by accessing the Cisco Bug
Toolkit.
The Internetworking Terms and Cisco Systems Acronyms online guides can be
found at <http://www.cisco.com/univercd/cc/td/doc/cisintwk/>
http://www.cisco.com/univercd/cc/td/doc/cisintwk/.
Impact:
The timing for the data channels traversing the switch is provided by the
control cards.
On the Cisco ONS15454, ONS15327, and ONS15454SDH hardware platforms,
whenever both the active and standby control cards are rebooting at the
same time, the synchronous data channels traversing the switch drop
traffic until the card reboots. Asynchronous data channels traversing the
switch are not impacted. Manageability functions provided by the network
element via the TCC+, XTC, and TCCi control cards are not available until
the control card reboots.
On the Cisco ONS15600 hardware platforms, whenever both the active and
standby control cards are rebooting at the same time, there is no impact
to the data channels traversing the switch because the TSC does a software
reset that does not affect the timing being provided by the TSC for the
data channels. Manageability functions provided by the network element via
the TSC control cards are not available until the control card reboots.
Software Versions and Fixes:
All these vulnerabilities for the ONS15454, ONS15327, and ONS15454SDH
platforms are fixed in the Cisco ONS software Releases 4.0 and later for
the affected platforms.
All these vulnerabilities for the ONS15600 platforms are fixed in the
Cisco ONS software Release 1.1, which will be available in September 2003.
Upgrade procedures can be found as indicated below.
* The procedure to upgrade to the fixed software version on the Cisco
ONS15454 hardware is detailed at
<http://www.cisco.com/univercd/cc/td/doc/product/ong/15400/r40docs/sftupgrd/index.htm> http://www.cisco.com/univercd/cc/td/doc/product/ong/15400/r40docs/sftupgrd/index.htm.
* The procedure to upgrade to the fixed software version on the Cisco
ONS15327 hardware is detailed at
<http://www.cisco.com/univercd/cc/td/doc/product/ong/15327/327doc40/index.htm> http://www.cisco.com/univercd/cc/td/doc/product/ong/15327/327doc40/index.htm.
* The procedure to upgrade to the fixed software version on the Cisco
ONS1600 hardware is detailed at
<http://cisco.com/univercd/cc/td/doc/product/ong/15600/index.htm>
http://cisco.com/univercd/cc/td/doc/product/ong/15600/index.htm.
Obtaining Fixed Software:
Cisco is offering free software upgrades to address these vulnerabilities
for all affected customers. Customers may only install and expect support
for the feature sets they have purchased.
Customers with service contracts should contact their regular update
channels to obtain the free software upgrade identified via this advisory.
For most customers with service contracts, this means that upgrades should
be obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com/tacpage/sw-center/sw-optical.shtml (registered
customers only).
Customers whose Cisco products are provided or maintained through a prior
or existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with obtaining the free software
upgrade(s).
Customers who purchased directly from Cisco but who do not hold a Cisco
service contract, and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale, should obtain fixed software by contacting the Cisco Technical
Assistance Center (TAC) using the contact information listed below. In
these cases, customers are entitled to obtain an upgrade to a later
version of the same release or as indicated by the applicable corrected
software version in the Software Versions and Fixes section (noted above).
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
See <http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml>
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional
TAC contact information, including special localized telephone numbers and
instructions and e-mail addresses for use in various languages.
Please have your product serial number available and give the URL of this
advisory as evidence of your entitlement to a free upgrade.
Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.
Workarounds:
The Cisco PSIRT recommends that affected users upgrade to a fixed software
version of code as soon as possible.
Use Unicast Reverse Path Forwarding and access control lists on routers
and firewalls to allow only valid network management workstations gain FTP
and Telnet access to the TCC+, XTC, TCCi, or TSC control cards.
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com> Cisco
Systems Product Security Incident Response Team.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NEWS] MDG Web Server 4D Buffer Overflow (GET)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
