|
SANS Critical Vulnerability - Weekly Alert - Monday May 5th, 2003
TWO telephony dDoS Vulnerabilities published
(1) HIGH: Cisco ONS Platform Denial of Service
Affected Products
Cisco ONS15454 Optical Transport Platform (rel. 3.0-3.41)
Cisco ONS15327 Edge Optical Transport Platform (rel. 3.3-3.41)
Cisco ONS15454SDH Multiplexer Platform (rel. 3.3-3.41)
Cisco ONS15600 Multiservice Switching Platform (rel. 1.0)
Description
Multiple Cisco ONS devices are vulnerable to a Denial of Service attack that can be launched from Nessus. The affected ONS hardware platforms are managed via control cards that are typically connected to a protected internal network. These control cards provide Telnet and FTP services that can be attacked by specially formed input, such as that sent by a Nessus vulnerability scan. A successful attack causes both the active and the standby ONS control cards to reboot simultaneously, which causes the synchronous data channels traversing the switch to drop traffic until the reboot completes (exception ONS15600). In addition, the management functions provided by the control cards are unavailable during reboot. An attacker could execute this attack repeatedly, leading to a persistent denial of service condition.
Council Site Actions
Only one reporting council sites is using the ONS product. This site does not have any externally facing ONS systems and the internal devices are very limited. They consider this to be a very low threat due to the small internal deployment, so no action will be taken.
Risk A remote attacker can cause a Cisco ONS device to become unavailable to the network.
Deployment Significant.
According to the Cisco website, over 30,000 units are deployed worldwide, typically in mission critical capacities.
Ease of Exploitation Trivial.
The attack can be launched using the free Nessus vulnerability scanner. The vulnerable services are typically not exposed to the Internet however.
Status Vendor confirmed. The problem is fixed in ONS software release 4.0 and later for the ONS15454, ONS15327, and ONS15454SDH platforms. A fix for the ONS15600 will be made available in September 2003 in software Release 1.1.
References
Cisco Security Advisory
http//archives.neohapsis.com/archives/vulnwatch/2003-q2/0050.html
http//www.cisco.com/warp/public/707/cisco-sa-20030501-ons.shtml
Cisco Product Pages
http//www.cisco.com/warp/public/cc/pd/olpl/metro/on15454/index.shtml
http//www.cisco.com/warp/public/cc/pd/olpl/metro/on15327/index.shtml
**********************************************************************************************************************
(2) HIGHL 3Com NBX Phone Manager Denial of Service
Affected Products
3Com SuperStack 3 NBX
3Com NBX 100
Description
The 3Com NBX products provide network telephony connectivity for up to 1500 lines/devices. These products utilize the VxWorks real time operating system (RTOS), and contain an FTP server that cannot be restricted or disabled. The FTP server contains a buffer overflow vulnerability that can be triggered by connecting to the FTP server port and sending a command of the form "CEL AAAAAAAA" where the string of A's is about 2048 characters long. The attack disables the FTP server, the web-based administrative console and the call manager. All diagnostics are disabled and no new calls can be established. Any calls in progress cannot be interrupted, potentially leading to inflated costs due to long distance calls not being disconnected properly. An affected device requires a hard reboot to return to service.
Deployment Significant.
The 3Com voice product line is relied upon by many organizations worldwide.
Ease of Exploitation Trivial.
The attack can easily be executed using only a telnet client.
Status The advisory indicates vendor confirmation, and that VxWorks 5.4 and 5.5 may also be affected. A solution is not yet available from 3Com. A possible workaround is to block network access to port 21/tcp on the NBX.
References
Security Advisory by Michael S. Scheidell
http//archives.neohapsis.com/archives/vulnwatch/2003-q2/0045.html
3Com NBX Solution Stories
http//www.3com.com/solutions/en_US/cgcase.html?cat=NBXss3&view=product
http//www.3com.com/solutions/en_US/cgcase.html?cat=NBX100&view=product
|
