PT-2009-2177 · Avaya · Avaya Communication Manager+1

Published 2009-04-10 · Updated 2017-08-17 · CVE-2008-6708

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya SIP Enablement Services (SES) versions 3.x through 4.0 Avaya Communication Manager versions 3.1.x through 4.x

Description The issue affects the Web management interface, allowing remote authenticated administrators to gain root privileges. This is related to the configuration of data viewing or restoring parameters.

Recommendations For Avaya SIP Enablement Services (SES) versions 3.x through 4.0, restrict access to the Web management interface until a fix is available. For Avaya Communication Manager versions 3.1.x through 4.x, limit the configuration of data viewing or restoring parameters to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-6708

Affected Products

Avaya Communication Manager

Avaya Sip Enablement Services

References · 8

• http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6708 · Security Note
• http://securityfocus.com/bid/29939 · Note
• http://secunia.com/advisories/30751 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43390 · Note
• http://osvdb.org/46604 · Note
• http://vupen.com/english/advisories/2008/1943/references · Note
• http://voipshield.com/research-details.php?id=77 · Note