PT-2008-5137 · Avaya · Avaya Communication Manager+1

Publicado 2008-08-25 · Atualizado 2017-08-08 · CVE-2008-3778

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avaya SIP Enablement Services version 5.0 Avaya Communication Manager (CM) version 5.0 on the S8300C with SES enabled

Description The issue allows remote attackers to cause a denial of service or gain privileges via an update request to the remote management interface in SIP Enablement Services (SES) Server, due to the interface proceeding with Core router updates even when a login is invalid.

Recommendations For Avaya SIP Enablement Services version 5.0, update the software to prevent the interface from proceeding with Core router updates when a login is invalid. For Avaya Communication Manager (CM) version 5.0 on the S8300C with SES enabled, update the software to prevent the interface from proceeding with Core router updates when a login is invalid.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-3778

Produtos afetados

Avaya Communication Manager

Avaya Sip Enablement Services

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-3778 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44585 · Nota
• http://securityfocus.com/bid/30758 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm · Nota