3Com SS3 4400 Switch Information Disclosure Vulnerability
BID:20736
Info
3Com SS3 4400 Switch Information Disclosure Vulnerability
| Bugtraq ID: | 20736 |
| Class: | Configuration Error |
| CVE: |
CVE-2006-5382 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 25 2006 12:00AM |
| Updated: | Oct 26 2006 06:38PM |
| Credit: | Andrew Brennan is credited with the discovery of this vulnerability. |
| Vulnerable: |
3Com SuperStack 3 Switch 4400.0 SE 3Com SuperStack 3 Switch 4400.0 PWR 3Com SuperStack 3 Switch 4400.0 FX 3Com SuperStack 3 Switch 4400.0 |
| Not Vulnerable: | |
Discussion
3Com SS3 4400 Switch Information Disclosure Vulnerability
3Com SS3 4400 Switch products are prone to an information-disclosure vulnerability.
An attacker can exploit this issue to retrieve potentially sensitive information. The impact of successful exploits may allow various operations on the device, including disabling ports and reconfiguring a VLAN.
Note that this issue may be exploited only through the management VLAN that the affected device is connected to.
Firmware versions 5.11, 6.00, and 6.10 or earlier are vulnerable.
3Com SS3 4400 Switch products are prone to an information-disclosure vulnerability.
An attacker can exploit this issue to retrieve potentially sensitive information. The impact of successful exploits may allow various operations on the device, including disabling ports and reconfiguring a VLAN.
Note that this issue may be exploited only through the management VLAN that the affected device is connected to.
Firmware versions 5.11, 6.00, and 6.10 or earlier are vulnerable.
Exploit / POC
3Com SS3 4400 Switch Information Disclosure Vulnerability
Attackers can exploit this issue using network packet sniffers.
Attackers can exploit this issue using network packet sniffers.
Solution / Fix
3Com SS3 4400 Switch Information Disclosure Vulnerability
Solution:
The vendor has released an advisory and fixes to address this issue. Please see the referenced advisory for more information on obtaining and applying fixes.
Solution:
The vendor has released an advisory and fixes to address this issue. Please see the referenced advisory for more information on obtaining and applying fixes.