Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized FTP Access Vulnerability

Bugtraq ID:	6076
Class:	Access Validation Error
CVE:	CVE-2002-1553
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	This issue was reported in a Cisco Security Advisory.
Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.3 Cisco ONS 15454 Optical Transport Platform 3.2 .0 Cisco ONS 15454 Optical Transport Platform 3.1 .0 Cisco ONS 15454 Optical Transport Platform 3.0 Cisco ONS 15327 3.3 Cisco ONS 15327 3.2 Cisco ONS 15327 3.1 Cisco ONS 15327 3.0
Not Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.4 Cisco ONS 15327 3.4

Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized FTP Access Vulnerability

It is possible for attackers to authenticate to FTP services on TCC, TCC+ and XTC control cards using a non-existent username/password. Unauthorized FTP access will enable an attacker to upload modified configuration files or delete software images.

To exploit this issue, the attacker must be able to access the FTP services on TCC, TCC+ and XTC control cards.

Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized FTP Access Vulnerability

There is no exploit required.

Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized FTP Access Vulnerability

Solution:
The vendor has released fixes addressing the issue.

Further details about obtaining necessary fixes can be found in the Cisco advisory.

Cisco ONS15454/ONS15327 Optical Transport Platforms Unauthorized FTP Access Vulnerability

References: