Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial Of Service Vulnerability

Bugtraq ID:	6084
Class:	Design Error
CVE:	CVE-2002-1556
Remote:	Yes
Local:	No
Published:	Oct 31 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	This issue was reported in a Cisco Security Advisory.
Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.3 Cisco ONS 15454 Optical Transport Platform 3.2 .0 Cisco ONS 15454 Optical Transport Platform 3.1 .0 Cisco ONS 15454 Optical Transport Platform 3.0 Cisco ONS 15327 3.3 Cisco ONS 15327 3.2 Cisco ONS 15327 3.1 Cisco ONS 15327 3.0
Not Vulnerable:	Cisco ONS 15454 Optical Transport Platform 3.4 Cisco ONS 15327 3.4

Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial Of Service Vulnerability

A vulnerability has been discovered in Cisco ONS1545 Optical Transport and Cisco ONS15327 Edge Optical Transport platforms.

It is possible for a remote attacker to cause TCC, TCC+, and XTC control cards to reset, by requesting a maliciously constructed HTTP request for a non-existing or invalid CORBA IOR object.

Exploiting this issue will result in the denial of legitimate network requests to the TCC, TCC+, or XTC control card.

Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial Of Service Vulnerability

No exploit is required.

Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial Of Service Vulnerability

Solution:
The vendor has released fixes addressing the issue.

Further details about obtaining necessary fixes can be found in the Cisco advisory.

Cisco ONS15454/ONS15327 Optical Transport Platforms CORBA IOR Denial Of Service Vulnerability

References: