PT-2007-4565 · Avaya · Avaya Ip Softphone

Published 2007-09-19 · Updated 2008-11-15 · CVE-2007-3286

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avaya IP Softphone versions prior to R5.2 SP3 Avaya IP Softphone version R6.0

Description The issue is related to multiple buffer overflows in unspecified ActiveX controls in COM objects. This allows remote attackers to execute arbitrary code via unspecified vectors.

Recommendations For Avaya IP Softphone versions prior to R5.2 SP3, update to R5.2 SP3 or later. For Avaya IP Softphone version R6.0, consider disabling the affected ActiveX controls in COM objects as a temporary workaround until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-3286

Affected Products

Avaya Ip Softphone

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-3286 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2007-314.htm · Note
• http://securityfocus.com/bid/25707 · Note
• http://osvdb.org/38258 · Note