Multiple Cisco ONS control cards fail to properly handle invalid TCP responses

2004-07-27T00:00:00
ID VU:277048
Type cert
Reporter CERT
Modified 2004-08-05T17:55:00

Description

Overview

A vulnerability exists in multiple control cards used by Cisco ONS devices. This vulnerability could allow a remote attacker to cause a denial-of-service condition.

Description

Cisco's Optical Networking product line consists of a series of devices designed to offer high-bandwidth data services. These optical devices are managed through a series of control cards, which vary depending on the model of the device. There is a vulnerability in the way the XTC, TCC/TCC+/TCC2 and TCCi/TCC2 control cards handle invalid TCP responses. By sending an invalid TCP response to a vulnerable optical device, a remote attacker can cause the connection to enter an invalid TCP state. This could result in the control cards reseting.

Vulnerable
Cisco ONS 15327 Edge Optical Transport Platform releases:

* 4.6(0) and 4.6(1)
* 4.1(0) to 4.1(3)
* 4.0(0) to 4.0(2)
* 3.x(x) and earlier

Cisco ONS 15454 Optical Transport Platform releases:

* 4.6(0) and 4.6(1)
* 4.5(x)
* 4.1(0) to 4.1(3)
* 4.0(0) to 4.0(2)
* 3.x(x)
* earlier than 2.3(5)

Cisco ONS 15454 SDH Multiplexer Platform releases:

* 4.6(0) and 4.6(1)
* 4.5(x)
* 4.1(0) to 4.1(3)
* 4.0(0) to 4.0(2)
* 3.x(x)
* earlier than 2.3(5)

Not vulnreable
Cisco ONS 15600 Multiservice Switching Platform


Impact

A remote, unauthenticated attacker could cause control cards to reset on an affected optical device. Repeated exploitation of this vulnerability could result in a denial of service.

For more information on the impact of this vulnerability, please refer to the "Impact" section of the Cisco Advisory.


Solution

Upgrade
Please refer to the "Software Versions and Fixes" section of the Cisco Advisory for more information on upgrading.


Vendor Information

277048

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems Inc. __ Affected

Updated: July 27, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please refer to the Cisco Advisory "Cisco ONS 15327, ONS 15454, ONS 15454 SDH, and ONS 15600 Malformed Packet Vulnerabilities".

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | |
Temporal | |
Environmental | |

References

  • <http://www.cisco.com/warp/public/707/cisco-sa-20040721-ons.shtml>
  • <http://www.cisco.com/en/US/products/hw/optical/>
  • <http://secunia.com/advisories/12117/>
  • <http://www.securitytracker.com/alerts/2004/Jul/1010749.html>

Acknowledgements

This vulnerability was reported by the Cisco Systems Product Security Incident Response Team (PSIRT).

This document was written by Damon Morda based on information provided by Cisco.

Other Information

CVE IDs: | None
---|---
Severity Metric: | 8.03
Date Public: | 2004-07-21
Date First Published: | 2004-07-27
Date Last Updated: | 2004-08-05 17:55 UTC
Document Revision: | 15