CVE-2006-1672

The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows remote attackers to execute arbitrary code on a CTC workstation, aka bug ID CSCea25049.

Published: Apr 7, 2006
Updated: Apr 13, 2023
CVE: CVE-2006-1672
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
cisco / transport_controller	4.0.x	4.0.x.x
cisco / ons_15454_mspp	-	-
cisco / ons_15600	-	-
cisco / ons_15310-cl_series	-	-
cisco / optical_networking_systems_software	3.2	3.2.x
cisco / optical_networking_systems_software	3.3.0	3.3.0.x
cisco / optical_networking_systems_software	3.4.0	3.4.0.x
cisco / optical_networking_systems_software	4.0.0	4.0.0.x
cisco / optical_networking_systems_software	3.1.0	3.1.0.x
cisco / optical_networking_systems_software	4.6(1)	4.6(1).x
cisco / optical_networking_systems_software	1.0	1.0.x
cisco / optical_networking_systems_software	1.1	1.1.x
cisco / optical_networking_systems_software	1.1(0)	1.1(0).x
cisco / optical_networking_systems_software	1.1(1)	1.1(1).x
cisco / optical_networking_systems_software	4.1(2)	4.1(2).x
cisco / optical_networking_systems_software	4.1(3)	4.1(3).x
cisco / optical_networking_systems_software	4.1.4	4.1.4.x
cisco / optical_networking_systems_software	4.6(0)	4.6(0).x
cisco / optical_networking_systems_software	4.0(2)	4.0(2).x
cisco / optical_networking_systems_software	4.1(0)	4.1(0).x
cisco / optical_networking_systems_software	4.1(1)	4.1(1).x
cisco / optical_networking_systems_software	4.0(1)	4.0(1).x
cisco / optical_networking_systems_software	1.3(0)	1.3(0).x
cisco / optical_networking_systems_software	3.0	3.0.x

Vulnerability Database

289,599

CVE-2006-1672