var-200303-0051
Vulnerability from variot

Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset) via an HTTP request to the TCC, TCC+ or XTC, in which the request contains an invalid CORBA Interoperable Object Reference (IOR). A vulnerability has been discovered in Cisco ONS1545 Optical Transport and Cisco ONS15327 Edge Optical Transport platforms. Exploiting this issue will result in the denial of legitimate network requests to the TCC, TCC+, or XTC control card. The Cisco ONS15454 and Cisco ONS15327 have an issue with illegal CORBA IOR requests. A remote attacker can exploit this vulnerability to reset the device, resulting in a denial of service. The CISCO BUG ID of this vulnerability is: CSCdw15690 < link: http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml >

Show details on source website

To clipboard 

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-200303-0051",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "optical networking systems software",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "3.2.0",
         },
         {
            model: "optical networking systems software",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "3.2",
         },
         {
            model: "optical networking systems software",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "3.3.0",
         },
         {
            model: "optical networking systems software",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "3.0",
         },
         {
            model: "optical networking systems software",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "3.1.0",
         },
         {
            model: "ons 15327",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.1",
         },
         {
            model: "ons 15454 optical transport platform",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.2.0",
         },
         {
            model: "ons 15327",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.2",
         },
         {
            model: "ons 15454 optical transport platform",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.1.0",
         },
         {
            model: "ons 15454 optical transport platform",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.0",
         },
         {
            model: "ons 15454 optical transport platform",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.3",
         },
         {
            model: "ons 15327",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.0",
         },
         {
            model: "ons 15327",
            scope: "eq",
            trust: 0.6,
            vendor: "cisco",
            version: "3.3",
         },
         {
            model: "ons optical transport platform",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "154543.3",
         },
         {
            model: "ons optical transport platform",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "154543.2.0",
         },
         {
            model: "ons optical transport platform",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "154543.1.0",
         },
         {
            model: "ons optical transport platform",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "154543.0",
         },
         {
            model: "ons",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "153273.3",
         },
         {
            model: "ons",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "153273.2",
         },
         {
            model: "ons",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "153273.1",
         },
         {
            model: "ons",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "153273.0",
         },
         {
            model: "ons optical transport platform",
            scope: "ne",
            trust: 0.3,
            vendor: "cisco",
            version: "154543.4",
         },
         {
            model: "ons",
            scope: "ne",
            trust: 0.3,
            vendor: "cisco",
            version: "153273.4",
         },
      ],
      sources: [
         {
            db: "BID",
            id: "6084",
         },
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   configurations: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/configurations#",
         children: {
            "@container": "@list",
         },
         cpe_match: {
            "@container": "@list",
         },
         data: {
            "@container": "@list",
         },
         nodes: {
            "@container": "@list",
         },
      },
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:optical_networking_systems_software:3.2:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:optical_networking_systems_software:3.3.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:optical_networking_systems_software:3.1.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:optical_networking_systems_software:3.2.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:optical_networking_systems_software:3.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "This issue was reported in a Cisco Security Advisory.",
      sources: [
         {
            db: "BID",
            id: "6084",
         },
      ],
      trust: 0.3,
   },
   cve: "CVE-2002-1556",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  acInsufInfo: false,
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "NVD",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  exploitabilityScore: 10,
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  obtainAllPrivilege: false,
                  obtainOtherPrivilege: false,
                  obtainUserPrivilege: false,
                  severity: "MEDIUM",
                  trust: 1,
                  userInteractionRequired: false,
                  vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5,
                  confidentialityImpact: "NONE",
                  exploitabilityScore: 10,
                  id: "VHN-5941",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 0.1,
                  vectorString: "AV:N/AC:L/AU:N/C:N/I:N/A:P",
                  version: "2.0",
               },
            ],
            cvssV3: [],
            severity: [
               {
                  author: "NVD",
                  id: "CVE-2002-1556",
                  trust: 1,
                  value: "MEDIUM",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-200303-104",
                  trust: 0.6,
                  value: "MEDIUM",
               },
               {
                  author: "VULHUB",
                  id: "VHN-5941",
                  trust: 0.1,
                  value: "MEDIUM",
               },
            ],
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Cisco ONS15454 and ONS15327 running ONS before 3.4 allows attackers to cause a denial of service (reset) via an HTTP request to the TCC, TCC+ or XTC, in which the request contains an invalid CORBA Interoperable Object Reference (IOR). A vulnerability has been discovered in Cisco ONS1545 Optical Transport and Cisco ONS15327 Edge Optical Transport platforms. \nExploiting this issue will result in the denial of legitimate network requests to the TCC, TCC+, or XTC control card. The Cisco ONS15454 and Cisco ONS15327 have an issue with illegal CORBA IOR requests. A remote attacker can exploit this vulnerability to reset the device, resulting in a denial of service. The CISCO BUG ID of this vulnerability is: CSCdw15690 <* link: http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml *>",
      sources: [
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "BID",
            id: "6084",
         },
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
      ],
      trust: 1.26,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2002-1556",
            trust: 2,
         },
         {
            db: "BID",
            id: "6084",
            trust: 2,
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
            trust: 0.7,
         },
         {
            db: "CISCO",
            id: "20021031 CISCO ONS15454 AND CISCO ONS15327 VULNERABILITIES",
            trust: 0.6,
         },
         {
            db: "XF",
            id: "10508",
            trust: 0.6,
         },
         {
            db: "VULHUB",
            id: "VHN-5941",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            db: "BID",
            id: "6084",
         },
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   id: "VAR-200303-0051",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
      ],
      trust: 0.01,
   },
   last_update_date: "2023-12-18T12:33:08.504000Z",
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "NVD-CWE-Other",
            trust: 1,
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 1.7,
            url: "http://www.securityfocus.com/bid/6084",
         },
         {
            trust: 1.7,
            url: "http://www.cisco.com/warp/public/707/ons-multiple-vuln-pub.shtml",
         },
         {
            trust: 1.7,
            url: "http://www.iss.net/security_center/static/10508.php",
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            db: "BID",
            id: "6084",
         },
         {
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2003-03-31T00:00:00",
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            date: "2002-10-31T00:00:00",
            db: "BID",
            id: "6084",
         },
         {
            date: "2003-03-31T05:00:00",
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            date: "2002-10-31T00:00:00",
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2018-10-30T00:00:00",
            db: "VULHUB",
            id: "VHN-5941",
         },
         {
            date: "2009-07-11T18:06:00",
            db: "BID",
            id: "6084",
         },
         {
            date: "2018-10-30T16:26:17.187000",
            db: "NVD",
            id: "CVE-2002-1556",
         },
         {
            date: "2005-10-20T00:00:00",
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
      trust: 0.6,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Cisco ONS15454/ONS15327 Optical fiber transmission platform CORBA IOR Remote Denial of Service Attack Vulnerability",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
      trust: 0.6,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Design Error",
      sources: [
         {
            db: "BID",
            id: "6084",
         },
         {
            db: "CNNVD",
            id: "CNNVD-200303-104",
         },
      ],
      trust: 0.9,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.