PT-2008-5136 · Avaya · Avaya Communication Manager+1

Publicado 2008-08-25 · Atualizado 2017-08-08 · CVE-2008-3777

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avaya SIP Enablement Services version 5.0 Avaya Communication Manager version 5.0 on the S8300C with SES enabled

Description The issue allows local users to obtain login credentials by reading the alarm and system logs during failed login attempts, as the SIP Enablement Services (SES) Server writes account names and passwords to these logs.

Recommendations For Avaya SIP Enablement Services version 5.0, consider disabling the logging of account names and passwords to the alarm and system logs to prevent local users from obtaining login credentials. For Avaya Communication Manager version 5.0 on the S8300C with SES enabled, restrict access to the alarm and system logs to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3777

Produtos afetados

Avaya Communication Manager

Avaya Sip Enablement Services

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/44586 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3777 · Nota de Segurança
• http://securityfocus.com/bid/30758 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm · Nota