Alcatel AOS Default Telnet Server Remote Access Vulnerability

Bugtraq ID:	6220
Class:	Design Error
CVE:	CVE-2002-1272
Remote:	Yes
Local:	No
Published:	Nov 21 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Vulnerability discovery credited to Olivier Paridaens and Jeff Hayes of Alcatel.
Vulnerable:	Alcatel-Lucent AOS 5.1.1
Not Vulnerable:	Alcatel-Lucent AOS 5.1.1 .R03 Alcatel-Lucent AOS 5.1.1 .R02

Alcatel AOS Default Telnet Server Remote Access Vulnerability

AOS is the Alcatel Operating System, used on Alcatel OmniSwitch 7700 and 7800 models. It is distributed and maintained by Alcatel.

It has been discovered that an unintended back door is built into some releases of AOS. Some versions of AOS bind a telnet server to TCP port 6778. This server could allow a remote user unauthorized access to a system running AOS.

Alcatel AOS Default Telnet Server Remote Access Vulnerability

No exploit is required for this vulnerability.

Alcatel AOS Default Telnet Server Remote Access Vulnerability

Solution:
Fixes have been made available in versions 5.1.1.R02 and 5.1.1.R03 of AOS. Customers are advised to contact customer support for upgrades.

Alcatel AOS Default Telnet Server Remote Access Vulnerability

References:

• CERT Advisory CA-2002-32 Backdoor in Alcatel OmniSwitch AOS (CERT/CC)
  
• Support Homepage (Alcatel)