dbcve.org
Transport ControllerApplication · Cisco

CVE-2006-1672

HIGH · 7.5 CVSS v2.0 Published 2006-04-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The installation of Cisco Transport Controller (CTC) for Cisco Optical Networking System (ONS) 15000 series nodes adds a Java policy file entry with a wildcard that grants the java.security.AllPermission permission to any http URL containing "fs/LAUNCHER.jar", which allows remote attackers to execute arbitrary code on a CTC workstation, aka bug ID CSCea25049.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Cisco Transport Controller (CTC) installation for ONS 15000 series creates a Java security policy file containing a wildcard entry that grants java.security.AllPermission to any HTTP URL containing 'fs/LAUNCHER.jar'. This overly permissive policy allows remote attackers to serve malicious JAR files from any HTTP server and achieve arbitrary code execution on CTC workstations.

MitigationRemove or restrict the wildcard Java policy entry granting AllPermission to remove the excessive privilege, replacing it with specific minimal permissions required for legitimate CTC functionality, or disable the policy file if not required.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Transport ControllerApplication
Affected:= 4.0.x
Optical Networking Systems SoftwareApplication
Affected:= 1.0= 1.1= 1.1\(0\)= 1.1\(1\)= 1.3\(0\)= 3.0= 3.1.0= 3.2= 3.3.0= 3.4.0= 4.0\(1\)= 4.0\(2\)
Ons 15310 Cl SeriesHardware / appliance
Affected:= 0
Ons 15600Hardware / appliance
Affected:= 0
Ons 15454 MsppOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify Cisco Transport Controller installation
    Check for the presence of the Cisco Transport Controller software on the system. Look for CTC installation directories or the CTC launcher application typically found in the Cisco ONS 15000 series management path.
    Affected if Cisco Transport Controller version 4.0.x is installed, or Cisco Optical Networking Systems Software versions 1.0 through 4.0(2) are present, or any version of Cisco ONS 15310 CL Series, Cisco ONS 15600, or Cisco ONS 15454 MSPP is running.
  2. Locate the Java security policy file
    Find the Java security policy file used by the CTC installation. This is typically named .java.policy or java.policy and resides in the user's home directory or within the CTC application directory structure.
    Affected if The policy file exists in the CTC installation path or user home directory.
  3. Inspect policy file for wildcard AllPermission entry
    Open the policy file in a text editor and search for any grant entries that contain 'fs/LAUNCHER.jar' combined with 'java.security.AllPermission'. The vulnerable entry uses a wildcard URL pattern that matches any HTTP server path containing this string.
    Affected if The policy file contains a grant statement that grants java.security.AllPermission to a URL pattern containing 'fs/LAUNCHER.jar' with a wildcard or wildcard-like pattern.
  4. Confirm the vulnerable URL pattern scope
    Examine the specific URL permission grant in the policy file. The vulnerability exists when the permission uses a wildcard that allows any HTTP server to serve the LAUNCHER.jar file, rather than restricting it to a specific trusted server.
    Affected if The URL pattern in the grant statement uses a wildcard (*) that permits loading JAR files from any HTTP server containing 'fs/LAUNCHER.jar' in the path.

You are affected if Cisco Transport Controller or Cisco ONS 15000 series software is installed and the Java policy file contains a wildcard grant of AllPermission to URLs containing 'fs/LAUNCHER.jar', which allows untrusted remote servers to load and execute arbitrary Java code.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Remove or restrict the wildcard Java policy entry granting AllPermission to remove the excessive privilege, replacing it with specific minimal permissions required for legitimate CTC functionality, or disable the policy file if not required.

Fix this in Transport Controller Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,390
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,224.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2006-1672 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2006-1672 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data