PT-2008-6761 · Avaya · Avaya Communication Manager

Published 2008-12-24 · Updated 2017-08-08 · CVE-2008-5709

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya Communication Manager versions 3.1 through 3.1.4 SP1 Avaya Communication Manager versions 4.0 through 4.0.3 Avaya Communication Manager versions 5.0 through 5.0 SP2

Description The issue affects the web management interface, allowing remote authenticated users to execute arbitrary code. This is possible through unknown attack vectors in the Set Static Routes and Backup History components.

Recommendations For Avaya Communication Manager versions 3.1 through 3.1.4 SP1, update to version 3.1.4 SP2. For Avaya Communication Manager versions 4.0 through 4.0.3, update to version 4.0.3 SP1. For Avaya Communication Manager versions 5.0 through 5.0 SP2, update to version 5.0 SP3.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5709

Affected Products

Avaya Communication Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-5709 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-391.htm · Vendor Advisory
• http://secunia.com/advisories/32204 · Vendor Advisory
• http://voipshield.com/research-details.php?id=121 · Note
• http://securityfocus.com/bid/31645 · Note
• http://voipshield.com/research-details.php?id=122 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45747 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45749 · Note
• http://vupen.com/english/advisories/2008/2772 · Note