PT-2007-6417 · Alcatel Lucent · Alcatel-Lucent Omnipcx Enterprise

Publicado 2007-11-20 · Atualizado 2018-10-15 · CVE-2007-5361

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Alcatel-Lucent OmniPCX Enterprise versions 7.1 and earlier

Description: The issue allows remote attackers to cause a denial of service, such as loss of audio, or intercept voice communications. This is achieved through a crafted TFTP request containing the phone's MAC address in the filename, which exploits the caching mechanism of the Communication Server during a TFTP request from an IP Touch phone.

Recommendations: For Alcatel-Lucent OmniPCX Enterprise versions 7.1 and earlier, consider restricting access to the TFTP service to minimize the risk of exploitation. As a temporary workaround, limit the ability to send crafted TFTP requests to the Communication Server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-5361

Produtos afetados

Alcatel-Lucent Omnipcx Enterprise

Referências · 11

• http://www1.alcatel-lucent.com/psirt/statements/2007004/IPTouchDOS.pdf · Nota
• http://securityfocus.com/bid/26494 · Nota
• http://csnc.ch/static/advisory/csnc/alcatel_omnipcx_enterprise_audio_rerouting_vulnerability_v1.0.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5361 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3919 · Nota
• http://securityfocus.com/archive/1/483925/100/0/threaded · Nota
• http://osvdb.org/40522 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38560 · Nota
• http://securityreason.com/securityalert/3387 · Nota
• http://securitytracker.com/id?1018983 · Nota
• http://secunia.com/advisories/27710 · Nota