Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP Community String Vulnerability

Bugtraq ID:	6081
Class:	Design Error
CVE:	CVE-2002-1555
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	This issue was reported in a Cisco Security Advisory.
Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.3 Cisco ONS 15454 Optical Transport Platform 3.2 .0 Cisco ONS 15454 Optical Transport Platform 3.1 .0 Cisco ONS 15454 Optical Transport Platform 3.0 Cisco ONS 15327 3.3 Cisco ONS 15327 3.2 Cisco ONS 15327 3.1 Cisco ONS 15327 3.0
Not Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.4 Cisco ONS 15327 3.4

Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP Community String Vulnerability

It has been reported that Cisco ONS15454/ONS15327 Optical Transport Platforms are not able to change the default SNMP "Public" community string.

By establishing an SNMP connection to a TCC, TCC+ or XTC control card, it is possible for a remote attacker to obtain sensitive network information via the "public" SNMP community string.

Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP Community String Vulnerability

This issue may be exploited with a SNMP client.

Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP Community String Vulnerability

Solution:
The vendor has released fixes addressing the issue.

Further details about obtaining necessary fixes can be found in the Cisco advisory.

Cisco ONS15454/ONS15327 Optical Transport Platforms Public SNMP Community String Vulnerability

References: