Details of VAR-201703-0323

ID

VAR-201703-0323

CVE

CVE-2015-1610

TITLE

OpenDaylight l2switch of hosttracker Vulnerability in changing host location information

Trust: 0.8

sources: JVNDB: JVNDB-2015-007422

DESCRIPTION

hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing.". OpenDaylight l2switch of hosttracker Contains a vulnerability that changes the location of the host. OpenDaylight l2switch is prone to a security-bypass vulnerability. Successfully exploiting this issue will allow attackers to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. OpenDaylight is a project of the Linux Foundation in the United States. It is a community-led open source software-defined network framework. It includes a set of modules that can perform network tasks that need to be completed quickly. l2switch is one of the projects that provides layer 2 switch functionality

Trust: 1.98

sources: NVD: CVE-2015-1610 // JVNDB: JVNDB-2015-007422 // BID: 73251 // VULHUB: VHN-79571

AFFECTED PRODUCTS

vendor:	opendaylight	model:	l2switch	scope:	eq	version:	-	Trust: 1.6
vendor:	opendaylight	model:	l2switch	scope:	-	version:	-	Trust: 0.8
vendor:	opendaylight	model:	l2switch	scope:	eq	version:	0	Trust: 0.3

sources: BID: 73251 // JVNDB: JVNDB-2015-007422 // CNNVD: CNNVD-201503-436 // NVD: CVE-2015-1610

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-1610
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-1610
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201503-436
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-79571
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-1610
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-79571
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-1610
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-79571 // JVNDB: JVNDB-2015-007422 // CNNVD: CNNVD-201503-436 // NVD: CVE-2015-1610

PROBLEMTYPE DATA

problemtype:

CWE-264

Trust: 1.9

sources: VULHUB: VHN-79571 // JVNDB: JVNDB-2015-007422 // NVD: CVE-2015-1610

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201503-436

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201503-436

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-007422

PATCH

title:

[Moderate] CVE-2015-1610 l2switch: topology spoofing via hosttracker

url:

https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1610_l2switch:_topology_spoofing_via_hosttracker

Trust: 0.8

sources: JVNDB: JVNDB-2015-007422

EXTERNAL IDS

db:	NVD	id:	CVE-2015-1610	Trust: 2.8
db:	BID	id:	73251	Trust: 2.8
db:	JVNDB	id:	JVNDB-2015-007422	Trust: 0.8
db:	CNNVD	id:	CNNVD-201503-436	Trust: 0.7
db:	VULHUB	id:	VHN-79571	Trust: 0.1

sources: VULHUB: VHN-79571 // BID: 73251 // JVNDB: JVNDB-2015-007422 // CNNVD: CNNVD-201503-436 // NVD: CVE-2015-1610

REFERENCES

url:	http://www.securityfocus.com/bid/73251	Trust: 2.5
url:	http://www.internetsociety.org/sites/default/files/10_4_2.pdf	Trust: 2.5
url:	https://wiki.opendaylight.org/view/security_advisories#.5bmoderate.5d_cve-2015-1610_l2switch:_topology_spoofing_via_hosttracker	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1610	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2015-1610	Trust: 0.8
url:	http://www.opendaylight.org/	Trust: 0.3
url:	https://wiki.opendaylight.org/view/l2_switch:main#introduction	Trust: 0.3
url:	https://bugs.opendaylight.org/show_bug.cgi?id=2724	Trust: 0.3
url:	https://wiki.opendaylight.org/view/security_advisories	Trust: 0.3

sources: VULHUB: VHN-79571 // BID: 73251 // JVNDB: JVNDB-2015-007422 // CNNVD: CNNVD-201503-436 // NVD: CVE-2015-1610

CREDITS

Lei Xu of Texas A&M

Trust: 0.9

sources: BID: 73251 // CNNVD: CNNVD-201503-436

SOURCES

db:	VULHUB	id:	VHN-79571
db:	BID	id:	73251
db:	JVNDB	id:	JVNDB-2015-007422
db:	CNNVD	id:	CNNVD-201503-436
db:	NVD	id:	CVE-2015-1610

LAST UPDATE DATE

2025-04-20T23:33:00.675000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-79571	date:	2017-03-23T00:00:00
db:	BID	id:	73251	date:	2015-03-20T00:00:00
db:	JVNDB	id:	JVNDB-2015-007422	date:	2017-04-19T00:00:00
db:	CNNVD	id:	CNNVD-201503-436	date:	2017-03-21T00:00:00
db:	NVD	id:	CVE-2015-1610	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-79571	date:	2017-03-20T00:00:00
db:	BID	id:	73251	date:	2015-03-20T00:00:00
db:	JVNDB	id:	JVNDB-2015-007422	date:	2017-04-19T00:00:00
db:	CNNVD	id:	CNNVD-201503-436	date:	2015-03-24T00:00:00
db:	NVD	id:	CVE-2015-1610	date:	2017-03-20T16:59:01.377