PT-2002-1280 · Nortel · Nortel Alteon Acedirector Webos

Published 2002-05-16 · Updated 2008-09-11 · CVE-2002-0209

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nortel Alteon ACEdirector WebOS version 9.0

Description The issue allows remote attackers to determine the real IP address of a web server with a half-closed session. This occurs when the Server Load Balancing (SLB) and Cookie-Based Persistence features are enabled, causing ACEdirector to send packets from the server without changing the address to the virtual IP address.

Recommendations For Nortel Alteon ACEdirector WebOS version 9.0, consider disabling the Cookie-Based Persistence feature as a temporary workaround to minimize the risk of exploitation. Restrict access to the Server Load Balancing (SLB) feature until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2002-0209

Affected Products

Nortel Alteon Acedirector Webos

References · 6

• 🔥 https://exploit-db.com/exploits/21243 · Exploit
• http://iss.net/security_center/static/8010.php · Vendor Advisory
• http://online.securityfocus.com/archive/1/252455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0209 · Security Note
• http://online.securityfocus.com/archive/1/261548 · Note
• http://securityfocus.com/bid/3964 · Note