PT-2008-4505 · Avaya · Avaya Communication Manager+1
Published
2008-07-09
·
Updated
2017-08-08
·
CVE-2008-3081
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Avaya Message Storage Server (MSS) versions 3.x through 4.0
Avaya Communication Manager versions 3.1.x
Description:
The issue is related to multiple unspecified input validation vulnerabilities in the Web management interface of the affected software. These vulnerabilities allow remote authenticated administrators to execute arbitrary commands as user vexvm. The vulnerabilities are related to various configuration settings and actions, including SFTP Remote Store configuration, remote FTP storage settings, name server lookup, pinging another host, TCP/IP Networking parameter configuration, external hosts configuration, Windows domain parameter configuration, date, time, and NTP server configuration, alarm settings, command line history form, maintenance form, and server events form.
Recommendations:
For Avaya Message Storage Server (MSS) versions 3.x through 4.0, consider restricting access to the Web management interface until a fix is available.
For Avaya Communication Manager versions 3.1.x, avoid using the vulnerable configuration settings and actions until the issue is resolved.
As a temporary workaround, consider disabling the remote administration feature for the Web management interface until a patch is available.
Restrict access to the
vexvm user account to minimize the risk of exploitation.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avaya Communication Manager
Avaya Message Storage Server