What is the OSS (Operations Support System)?
The Operations Support System – Radio and Core (OSS-RC) provides a centralized interface into the radio and core components.
The Operations Support Systems are all those systems used by companies that provide communication services for networks’ integrated function.
Let’s consider the case of the activation of a new line for a customer, while the order and customer data are collected through the CRM, the configuration of the network is automated through the OSS.
For example, let’s consider the case of a client that requires the activation of a new telephone line. The systems that handle these requests/CRM gather user data, but it isn’t able to configure the network to provide the service to the customer. The OSSs allow telecommunications carriers to automate this process and also to carry out management operations of the networks, such as the update of the base-band systems located on the buildings of our cities.
Unfortunately, OSS systems also represent a “single-point-of-failure,” a Remote Code Execution (RCE) vulnerability affecting an OSS can allow attackers to potentially compromise all connected systems, including basebands.
The vulnerabilities have been reported to Ericsson by the researchers Alessandro Bosco, Mohamed Amine Ouad, and by the head of laboratory Massimiliano Brolli.
Below is the list of flaws reported to the vendor since 2001 and included in the National Vulnerability Database of the United States of America. They were only 10, two of which reported by the TIM.
Below the details for the two flaws published on the official page of the TIM RTR project.
CVE-2021-32569
In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager.
CVE-2021-32571
In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in the system undeleted but in folders accessible by top privileged accounts only.
Ethics in the search for vulnerabilities, in this historical period, is something very important and once identified, these vulnerabilities not documented (c.d. zeroday) must be immediately reported to the vendor avoiding to provide public information that allows their active exploitation by Threat Actors (TA) on systems without patches.
The TIM RTR laboratory has already discovered over 60 zero-day issues in the last two years, 4 of these vulnerabilities received a CSSV score of 9.8.
TIM is a leading company in the research of zero-day vulnerabilities and the results demonstrate the success of the RTR project.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, cyber security)
[adrotate banner=”5″]
[adrotate banner=”13″]
FBI warns Silent Ransom Group has targeted U.S. law firms for 2 years using callback…
The U.S. indicted Russian Rustam Gallyamov for leading the Qakbot botnet, which infected 700K+ devices…
Law enforcement operation codenamed 'Operation RapTor' led to the arrest of 270 dark web vendors…
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Samsung MagicINFO 9 Server vulnerability to its…
Signal implements new screen security on Windows 11, blocking screenshots by default to protect user…
This website uses cookies.
