PT-2008-5136 · Avaya · Avaya Communication Manager+1

Published 2008-08-25 · Updated 2017-08-08 · CVE-2008-3777

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avaya SIP Enablement Services version 5.0 Avaya Communication Manager version 5.0 on the S8300C with SES enabled

Description The issue allows local users to obtain login credentials by reading the alarm and system logs during failed login attempts, as the SIP Enablement Services (SES) Server writes account names and passwords to these logs.

Recommendations For Avaya SIP Enablement Services version 5.0, consider disabling the logging of account names and passwords to the alarm and system logs to prevent local users from obtaining login credentials. For Avaya Communication Manager version 5.0 on the S8300C with SES enabled, restrict access to the alarm and system logs to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3777

Affected Products

Avaya Communication Manager

Avaya Sip Enablement Services

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-3777 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44586 · Note
• http://securityfocus.com/bid/30758 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm · Note