CVE-2008-4383: Buffer Overflow
First published: Fri Oct 03 2008(Updated: )
Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Alcatel AOS | >=5.1<5.1.6.463.r02 | |
| Alcatel AOS | >=5.4<5.4.1.429.r01 | |
| Alcatel AOS | >=6.1.3<6.1.3.965.r01 | |
| Alcatel AOS | >=6.1.5<6.1.5.595.r01 | |
| Alcatel AOS | >=6.3<6.3.1.966.r01 | |
| Alcatel OmniSwitch | =os6600 | |
| Alcatel OmniSwitch | =os6800 | |
| Alcatel OmniSwitch | =os6850 | |
| Alcatel OmniSwitch | =os7000 | |
| Alcatel OmniSwitch | =os9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securitytracker.com/id?1020657
- http://www.layereddefense.com/alcatel12aug.html
- http://www1.alcatel-lucent.com/psirt/statements/2008002/OmniSwitch.htm
- http://secunia.com/advisories/31435
- http://securityreason.com/securityalert/4347
- http://www.vupen.com/english/advisories/2008/2346
- http://www.securityfocus.com/bid/30652
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44400
- http://www.securityfocus.com/archive/1/495343/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-4383?
CVE-2008-4383 is categorized as a medium severity vulnerability due to its potential for exploitation via a stack-based buffer overflow.
How do I fix CVE-2008-4383?
To mitigate CVE-2008-4383, upgrade the affected Alcatel OmniSwitch devices to the specified patched versions or later.
Which versions are affected by CVE-2008-4383?
Versions before 5.1.6.463.R02, 5.4.1.429.R01, 6.1.3.965.R01, 6.1.5.595.R01, and 6.3.1.96 of Alcatel OmniSwitch devices are vulnerable to CVE-2008-4383.
What types of devices are affected by CVE-2008-4383?
CVE-2008-4383 affects various models within the Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series.
Is CVE-2008-4383 remotely exploitable?
Yes, CVE-2008-4383 is remotely exploitable, allowing attackers to execute arbitrary code on affected devices.
- collector/nvd-historical
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/alcatel
- canonical/alcatel aos
- version/alcatel aos/5.1
- version/alcatel aos/5.4
- version/alcatel aos/6.1.3
- version/alcatel aos/6.1.5
- version/alcatel aos/6.3
- vendor/alcatel-lucent
- canonical/alcatel omniswitch
- version/alcatel omniswitch/os6600
- version/alcatel omniswitch/os6800
- version/alcatel omniswitch/os6850
- version/alcatel omniswitch/os7000
- version/alcatel omniswitch/os9000