PT-2012-2074 · Avaya · Avaya Aura Application Server 5300

Abdulaziz Hariri · Publicado 2012-07-03 · Atualizado 2012-07-17 · CVE-2011-5096

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya Aura Application Server 5300 versions 1.x before 1.0.2 Avaya Aura Application Server 5300 version 2.0 before Patch Bundle 10

Description The issue is related to a stack-based buffer overflow in the cstore.exe component of the Media Application Server. This can be exploited by remote attackers to execute arbitrary code. The exploitation occurs via a crafted cs anams parameter in a "CONTENT STORE ADMIN REQ" packet.

Recommendations For Avaya Aura Application Server 5300 versions 1.x before 1.0.2, update to version 1.0.2 or later. For Avaya Aura Application Server 5300 version 2.0, apply Patch Bundle 10 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2011-5096

Produtos afetados

Avaya Aura Application Server 5300

Referências · 3

• http://zerodayinitiative.com/advisories/ZDI-11-260 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5096 · Nota de Segurança
• https://downloads.avaya.com/css/P8/documents/100146108 · Aviso do Fabricante