CVE-2016-9796in critical feed1 exploit
Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 3…
Published 9 y ago · modified 4 mo ago · JSON
Summary
Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."
Exploit prediction (EPSS)
13.36% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
Exploits and detections
- EDB-40862 Alcatel Lucent Omnivista 8770 - Remote Code Execution · remote · 2016-12-04
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
References
- securityfocus.com /bid/94649 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/40862/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- youtube.com /watch?v=aq37lQKa9sk · x_refsource_MISC, x_transferred
- github.com /malerisch/omnivista-8770-unauth-rce · x_refsource_MISC, x_transferred
- blog.malerisch.net /2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.html · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-9796
- NVD: CVE-2016-9796
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.