PT-2007-4596 · Avaya · Avaya 4602Sw Ip Phone

Publicado 2007-06-21 · Atualizado 2017-07-29 · CVE-2007-3319

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avaya 4602SW IP Phone (Model 4602D02A) versions 2.2.2 and earlier

Description The issue concerns the Avaya 4602SW IP Phone, which does not properly utilize the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication. This allows remote attackers to conduct man-in-the-middle attacks, potentially leading to the hijacking or interception of communications.

Recommendations For Avaya 4602SW IP Phone (Model 4602D02A) versions 2.2.2 and earlier, consider updating the SIP firmware to a version that properly implements the cnonce parameter in the Authorization header to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the SIP requests to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-3319

Produtos afetados

Avaya 4602Sw Ip Phone

Referências · 7

• http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm · Aviso do Fabricante
• http://secunia.com/advisories/25747 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3319 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34972 · Nota
• http://osvdb.org/38115 · Nota
• http://sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299& · Nota
• http://securityfocus.com/bid/24539 · Nota