CVE-2008-4383 Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 b...
HighCVSS 10.0
EPSS 8.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alcatel aos | >= 5.1, < 5.1.6.463.r02 | 5.1.6.463.r02 |
| alcatel aos | >= 5.4, < 5.4.1.429.r01 | 5.4.1.429.r01 |
| alcatel aos | >= 6.1.3, < 6.1.3.965.r01 | 6.1.3.965.r01 |
| alcatel aos | >= 6.1.5, < 6.1.5.595.r01 | 6.1.5.595.r01 |
| alcatel aos | >= 6.3, < 6.3.1.966.r01 | 6.3.1.966.r01 |
References
- 31435 third-party-advisory
- 4347 third-party-advisory
- www.layereddefense.com broken-link
- 20080812 Layered Defense Research Advisory: Alcatel-Lucent OmniSwitch products, Stack Buffer Overflow mailing-list third-party-advisory vdb-entry
- 30652 third-party-advisory vdb-entry
- 1020657 third-party-advisory vdb-entry
- ADV-2008-2346 third-party-advisory vdb-entry
- www1.alcatel-lucent.com vendor-advisory
- omniswitch-session-bo(44400) third-party-advisory vdb-entry