CVE-2016-9796

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264 CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.htmlExploit, Third Party Advisory
http://www.securityfocus.com/bid/94649
https://github.com/malerisch/omnivista-8770-unauth-rceThird Party Advisory
https://www.exploit-db.com/exploits/40862/
https://www.youtube.com/watch?v=aq37lQKa9skExploit
http://blog.malerisch.net/2016/12/alcatel-omnivista-8770-unauth-rce-giop-corba.htmlExploit, Third Party Advisory
http://www.securityfocus.com/bid/94649
https://github.com/malerisch/omnivista-8770-unauth-rceThird Party Advisory
https://www.exploit-db.com/exploits/40862/
https://www.youtube.com/watch?v=aq37lQKa9skExploit

Timeline

Published: Dec 3, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-97975.3In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered b CVE-2016-97985.3In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by CVE-2016-97995.3In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by process CVE-2016-98005.3In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists becaus CVE-2016-98015.3In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dum CVE-2016-98025.3In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered b CVE-2016-98035.3In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists becau CVE-2016-98045.3In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "com CVE-2016-98067.8Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denia CVE-2016-98075.5The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (inval CVE-2016-98087.5The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a craft CVE-2016-98097.8Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a