CVE-2004-0306

Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS 15600 before 1.3(0) enable TFTP service on UDP port 69 by default, which allows remote attackers to GET or PUT ONS system files on the current active TCC in the /flash0 or /flash1 directories.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml	Patch Vendor Advisory
http://www.securityfocus.com/bid/9699	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15264

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:optical_networking_systems_software:1.0:::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.0\(1\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.0\(2\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.0.0:::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.1\(0\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.1\(1\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.1\(2\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.1\(3\):::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.1.0:::::::*
	cpe:2.3:a:cisco:optical_networking_systems_software:4.5:::::::*

History

No history.

Information

Published : 2004-11-23 05:00

Updated : 2023-12-10 10:17

NVD link : CVE-2004-0306

Mitre link : CVE-2004-0306

CVE.ORG link : CVE-2004-0306

JSON object : View

Products Affected

cisco

optical_networking_systems_software

CWE

NVD-CWE-Other

{"id": "CVE-2004-0306", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-11-23T05:00:00.000", "references": [{"url": "http://www.cisco.com/warp/public/707/cisco-sa-20040219-ONS.shtml", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/9699", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15264", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cisco ONS 15327 before 4.1(3), ONS 15454 before 4.6(1), ONS 15454 SD before 4.1(3), and Cisco ONS 15600 before 1.3(0) enable TFTP service on UDP port 69 by default, which allows remote attackers to GET or PUT ONS system files on the current active TCC in the /flash0 or /flash1 directories."}, {"lang": "es", "value": "Cisco ONS 15327 anteriores a 4.1(3), ONS 15454 anteriores a 4.6(1), ONS 15454 SD anteriores a 4.1(3), y Cisco ONS 15600 anteriores a 1.3(0) tienen activo el servicio TFTP en el puerto UDP 69 por defecto, lo que permite a atacantes remotos obtener (GET) o poner (PUT ON) ficheros de sistema en TCC activo acual en los directorios /flash0 y /flash1."}], "lastModified": "2018-10-30T16:26:17.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D1888FF-6126-4F40-A7EA-1ED5123FA729"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10988AA9-A807-4E70-8197-6F9EFC13AE86"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.0\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8951276-CDEF-4F54-93DF-B96DB10E6530"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D886A75-5A73-4B1C-8B2A-45D589267B37"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.1\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5A594C2-98BB-4AC5-9CC5-89FE97D63323"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.1\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B35325A-98F6-41DF-ADD8-91ED992A3ED3"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.1\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B06C5B-73C2-47F1-9ED6-B59F9C1C5AF1"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.1\\(3\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9758019-F6EA-4552-B070-5A9EBE73BB86"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E75DB3F4-94A8-4341-9C01-1F0DC25A3402"}, {"criteria": "cpe:2.3:a:cisco:optical_networking_systems_software:4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA524BE1-6B13-455A-96EA-17C1A71BD0F2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}