Summary
A public vulnerability has been disclosed affecting Alcatel-Lucent OmniVista 4760 and OmniVista 8770. This issue impacts the Web Directory Consultation client, presenting a potential for remote code execution with high privileges.
References
- Date: December 09th, 2019
- Risk: High
- Impact: Remote access / Disrupt service (denial of service)
- Attack expertise: Skilled
- Attack requirements: Remote (no account) on the same network plane as the product
- External resources:
Description of the vulnerability
The vulnerability arises from potential remote access to certain session files utilized by the Web Directory Consultation client. A comprehensive description of this discovery is publicly available at: https://git.lsd.cat/g/omnivista-rce/src/master/README.md
Status on Alcatel-Lucent Enterprise products
The OmniVista 4760 product is now deprecated. For OmniVista 8770, it is recommended to upgrade to the latest version to address this vulnerability.
Affected and Resolved Versions
Affected Releases: OmniVista 8770 before version 4.1.12
Not Affected Releases: OmniVista 8770 version 4.2
Resolution:
- OmniVista 8770 fixed in version 4.1.12 (January week 5 of 2020)
- OmniVista 8770 fixed in version 4.2 (April 2020 release)
History
Ed.01: Advisory creation on December 1st, 2019.
