PT-2015-5900 · Alcatel Lucent · Alcatel-Lucent Omniswitch

Published 2015-06-16 · Updated 2018-10-09 · CVE-2015-2804

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniSwitch versions prior to 6.6.4.309.R01 Alcatel-Lucent OmniSwitch 6.6.5.x versions prior to 6.6.5.80.R02

Description The management web interface generates weak session identifiers, allowing remote attackers to hijack arbitrary sessions via a brute force attack.

Recommendations For Alcatel-Lucent OmniSwitch versions prior to 6.6.4.309.R01, update to version 6.6.4.309.R01 or later. For Alcatel-Lucent OmniSwitch 6.6.5.x versions prior to 6.6.5.80.R02, update to version 6.6.5.80.R02 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2804

Affected Products

Alcatel-Lucent Omniswitch

References · 6

• 🔥 http://packetstormsecurity.com/files/132235/Alcatel-Lucent-OmniSwitch-Web-Interface-Weak-Session-ID.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jun/22 · Exploit
• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2015-003/-alcatel-lucent-omniswitch-web-interface-weak-session-id · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2804 · Security Note
• http://securityfocus.com/bid/75125 · Note
• http://securityfocus.com/archive/1/535731/100/0/threaded · Note