PT-2007-4596 · Avaya · Avaya 4602Sw Ip Phone

Published 2007-06-21 · Updated 2017-07-29 · CVE-2007-3319

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Avaya 4602SW IP Phone (Model 4602D02A) versions 2.2.2 and earlier

Description The issue concerns the Avaya 4602SW IP Phone, which does not properly utilize the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication. This allows remote attackers to conduct man-in-the-middle attacks, potentially leading to the hijacking or interception of communications.

Recommendations For Avaya 4602SW IP Phone (Model 4602D02A) versions 2.2.2 and earlier, consider updating the SIP firmware to a version that properly implements the cnonce parameter in the Authorization header to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the SIP requests to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3319

Affected Products

Avaya 4602Sw Ip Phone

References · 7

• http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm · Vendor Advisory
• http://secunia.com/advisories/25747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3319 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34972 · Note
• http://osvdb.org/38115 · Note
• http://sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299& · Note
• http://securityfocus.com/bid/24539 · Note