The Transaction Language 1 (TL1) login interface in Cisco ONS 15327 4.6(0) and 4.6(1) and 15454 and 15454 SDH 4.6(0) and 4.6(1), when a user account is configured with a blank password, allows remote attackers to gain unauthorized access by logging in with a password larger than 10 characters.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Optical_networking_systems_software | Cisco | 1.0 (including) | 1.0 (including) |
| Optical_networking_systems_software | Cisco | 1.1 (including) | 1.1 (including) |
| Optical_networking_systems_software | Cisco | 1.1(0) (including) | 1.1(0) (including) |
| Optical_networking_systems_software | Cisco | 1.1(1) (including) | 1.1(1) (including) |
| Optical_networking_systems_software | Cisco | 1.3(0) (including) | 1.3(0) (including) |
| Optical_networking_systems_software | Cisco | 2.3(5) (including) | 2.3(5) (including) |
| Optical_networking_systems_software | Cisco | 3.0 (including) | 3.0 (including) |
| Optical_networking_systems_software | Cisco | 3.1.0 (including) | 3.1.0 (including) |
| Optical_networking_systems_software | Cisco | 3.2 (including) | 3.2 (including) |
| Optical_networking_systems_software | Cisco | 3.2.0 (including) | 3.2.0 (including) |
| Optical_networking_systems_software | Cisco | 3.3.0 (including) | 3.3.0 (including) |
| Optical_networking_systems_software | Cisco | 3.4.0 (including) | 3.4.0 (including) |
| Optical_networking_systems_software | Cisco | 4.0(0) (including) | 4.0(0) (including) |
| Optical_networking_systems_software | Cisco | 4.0(1) (including) | 4.0(1) (including) |
| Optical_networking_systems_software | Cisco | 4.0(2) (including) | 4.0(2) (including) |
| Optical_networking_systems_software | Cisco | 4.0.0 (including) | 4.0.0 (including) |
| Optical_networking_systems_software | Cisco | 4.1(0) (including) | 4.1(0) (including) |
| Optical_networking_systems_software | Cisco | 4.1(1) (including) | 4.1(1) (including) |
| Optical_networking_systems_software | Cisco | 4.1(2) (including) | 4.1(2) (including) |
| Optical_networking_systems_software | Cisco | 4.1(3) (including) | 4.1(3) (including) |
| Optical_networking_systems_software | Cisco | 4.5 (including) | 4.5 (including) |
| Optical_networking_systems_software | Cisco | 4.6(0) (including) | 4.6(0) (including) |
| Optical_networking_systems_software | Cisco | 4.6(1) (including) | 4.6(1) (including) |
References
- http://secunia.com/advisories/12117
- http://www.cisco.com/warp/public/707/cisco-sa-20040721-ons.shtml
- http://www.kb.cert.org/vuls/id/760432
- http://www.securityfocus.com/bid/10768
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16766
- http://secunia.com/advisories/12117
- http://www.cisco.com/warp/public/707/cisco-sa-20040721-ons.shtml
- http://www.kb.cert.org/vuls/id/760432
- http://www.securityfocus.com/bid/10768
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16766