Lucene search

[email protected]CVE-2008-4383

HistoryOct 03, 2008 - 10:22 p.m.

CVE-2008-4383

2008-10-0322:22:41

CWE-119

[email protected]

web.nvd.nist.gov

cve-2008-4383

buffer overflow

agranet-emweb

alcatel omniswitch

remote code execution

nvd

vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

Low

0.146 Low

EPSS

Percentile

95.8%

JSON

Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.

Affected configurations

NVD

Node

alcatelaosRange5.1–5.1.6.463.r02

alcatelaosRange5.4–5.4.1.429.r01

alcatelaosRange6.1.3–6.1.3.965.r01

alcatelaosRange6.1.5–6.1.5.595.r01

alcatelaosRange6.3–6.3.1.966.r01

AND

alcatel-lucentomniswitchMatchos6600

alcatel-lucentomniswitchMatchos6800

alcatel-lucentomniswitchMatchos6850

alcatel-lucentomniswitchMatchos7000

alcatel-lucentomniswitchMatchos9000

CPENameOperatorVersion
alcatel:aosalcatel aoslt5.1.6.463.r02
alcatel:aosalcatel aoslt5.4.1.429.r01
alcatel:aosalcatel aoslt6.1.3.965.r01
alcatel:aosalcatel aoslt6.1.5.595.r01
alcatel:aosalcatel aoslt6.3.1.966.r01

CPE	Name	Operator	Version
alcatel:aos	alcatel aos	lt	5.1.6.463.r02
alcatel:aos	alcatel aos	lt	5.4.1.429.r01
alcatel:aos	alcatel aos	lt	6.1.3.965.r01
alcatel:aos	alcatel aos	lt	6.1.5.595.r01
alcatel:aos	alcatel aos	lt	6.3.1.966.r01

References

secunia.com/advisories/31435

securityreason.com/securityalert/4347

www.layereddefense.com/alcatel12aug.html

www.securityfocus.com/archive/1/495343/100/0/threaded

www.securityfocus.com/bid/30652

www.securitytracker.com/id?1020657

www.vupen.com/english/advisories/2008/2346

www1.alcatel-lucent.com/psirt/statements/2008002/OmniSwitch.htm

exchange.xforce.ibmcloud.com/vulnerabilities/44400

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.2 High

AI Score

Confidence

Low

0.146 Low

EPSS

Percentile

95.8%

JSON

Related for CVE-2008-4383

nessus1 prion1 cvelist1 nvd1