CVE-2008-4383

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS9000 Series devices with AoS 5.1 before 5.1.6.463.R02, 5.4 before 5.4.1.429.R01, 6.1.3 before 6.1.3.965.R01, 6.1.5 before 6.1.5.595.R01, and 6.3 before 6.3.1.966.R01 allows remote attackers to execute arbitrary code via a long Session cookie.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/31435Third Party Advisory
http://securityreason.com/securityalert/4347Third Party Advisory
http://www.layereddefense.com/alcatel12aug.htmlBroken Link
http://www.securityfocus.com/archive/1/495343/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30652Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020657Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/2346Third Party Advisory
http://www1.alcatel-lucent.com/psirt/statements/2008002/OmniSwitch.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44400Third Party Advisory, VDB Entry
http://secunia.com/advisories/31435Third Party Advisory
http://securityreason.com/securityalert/4347Third Party Advisory
http://www.layereddefense.com/alcatel12aug.htmlBroken Link
http://www.securityfocus.com/archive/1/495343/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/30652Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020657Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2008/2346Third Party Advisory
http://www1.alcatel-lucent.com/psirt/statements/2008002/OmniSwitch.htmVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44400Third Party Advisory, VDB Entry

Timeline

Published: Oct 3, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-43849.3Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow re CVE-2008-43859.3Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of CVE-2008-43879.3Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary cod CVE-2008-43889.3The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly val CVE-2008-43899.3Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows re CVE-2008-43907.5The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote CVE-2008-43919.3Stack-based buffer overflow in the SetSource method in the NetCamPlayerWeb11gv2 ActiveX control in NetCamPlayerWeb11gv2.ocx on the Cisco Lin CVE-2008-43926.4dnscache in Daniel J. Bernstein djbdns 1.05 does not prevent simultaneous identical outbound DNS queries, which makes it easier for remote a CVE-2008-43934.3Cross-site scripting (XSS) vulnerability in VeriSign Kontiki Delivery Management System (DMS) 5.0 and earlier allows remote attackers to inj CVE-2008-43946.9Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, wh CVE-2008-43958.3Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sendin CVE-2008-43969.3Stack-based buffer overflow in Safer Networking FileAlyzer 1.6.0.0 and 1.6.0.4 beta, and possibly other versions, allows user-assisted remot