Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability

Bugtraq ID:	6078
Class:	Design Error
CVE:	CVE-2002-1554
Remote:	No
Local:	Yes
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	This issue was reported in a Cisco Security Advisory.
Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.3 Cisco ONS 15454 Optical Transport Platform 3.2 .0 Cisco ONS 15454 Optical Transport Platform 3.1 .0 Cisco ONS 15454 Optical Transport Platform 3.0 Cisco ONS 15327 3.3 Cisco ONS 15327 3.2 Cisco ONS 15327 3.1 Cisco ONS 15327 3.0
Not Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.4 Cisco ONS 15327 3.4

Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability

Administrative authentication credentials are stored in plaintext in the running image database for TCC, TCC+ or XTC control cards. An attacker with access to the backup of the running image database may trivially retrieve these credentials.

Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability

There is no exploit code required.

Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability

Solution:
The vendor has released fixes addressing the issue.

Further details about obtaining necessary fixes can be found in the Cisco advisory.

Cisco ONS15454/ONS15327 Optical Transport Platforms Plaintext Credentials Vulnerability

References: