PT-2007-3667 · Nortel · Nortel Vpn Router

Published 2007-04-27 · Updated 2011-03-08 · CVE-2007-2334

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nortel VPN Router (aka Contivity) versions 1000, 2000, 4000, and 5000 before 5 05.149 Nortel VPN Router (aka Contivity) versions 5 05.3xx before 5 05.304 Nortel VPN Router (aka Contivity) versions 6.x before 6 05.140

Description The issue is related to two template HTML files that lack certain verification tags. This allows remote attackers to access the administration interface and change the device configuration via certain requests.

Recommendations For versions 1000, 2000, 4000, and 5000 before 5 05.149, update to version 5 05.149 or later. For versions 5 05.3xx before 5 05.304, update to version 5 05.304 or later. For versions 6.x before 6 05.140, update to version 6 05.140 or later.

Fix

Related Identifiers

CVE-2007-2334

Affected Products

Nortel Vpn Router

References · 8

• http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=567877&RenditionID=&poid=null · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2334 · Security Note
• http://secunia.com/advisories/24962 · Vendor Advisory
• http://securitytracker.com/id?1017943 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2334 · Note
• http://securityfocus.com/bid/23562 · Note
• http://osvdb.org/35056 · Note
• http://vupen.com/english/advisories/2007/1464 · Note