CVE-2016-9796

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3.0 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.html	Exploit Third Party Advisory
https://www.youtube.com/watch?v=aq37lQKa9sk	Exploit
https://github.com/malerisch/omnivista-8770-unauth-rce	Third Party Advisory
http://www.securityfocus.com/bid/94649
https://www.exploit-db.com/exploits/40862/

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:3.0:::::::*
	cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:2.0:::::::*
	cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:2.6:::::::*

Information

Published : 2016-12-02 22:59

Updated : 2017-09-02 18:29

NVD link : CVE-2016-9796

Mitre link : CVE-2016-9796

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

CWE-287

Improper Authentication

Advertisement

Products Affected

alcatel-lucent

omnivista_8770_network_management_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.html", "name": "http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.html", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.youtube.com/watch?v=aq37lQKa9sk", "name": "https://www.youtube.com/watch?v=aq37lQKa9sk", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "https://github.com/malerisch/omnivista-8770-unauth-rce", "name": "https://github.com/malerisch/omnivista-8770-unauth-rce", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/94649", "name": "94649", "tags": [], "refsource": "BID"}, {"url": "https://www.exploit-db.com/exploits/40862/", "name": "40862", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\\SYSTEM on the server. NOTE: The discoverer states \"The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-9796", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2016-12-03T06:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:alcatel-lucent:omnivista_8770_network_management_system:2.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-09-03T01:29Z"}