PT-2009-2178 · Avaya · Avaya Communication Manager+1

Published 2009-04-10 · Updated 2017-08-17 · CVE-2008-6709

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya SIP Enablement Services (SES) versions 3.x through 4.0 Avaya Communication Manager versions 3.1.x

Description The issue allows remote authenticated users to execute arbitrary commands, related to the configuration of local data viewing or restoring parameters in the Web management interface.

Recommendations For Avaya SIP Enablement Services (SES) versions 3.x through 4.0, restrict access to the Web management interface until a fix is available. For Avaya Communication Manager versions 3.1.x, consider disabling remote access to the configuration of local data viewing or restoring parameters as a temporary workaround.

Fix

Related Identifiers

CVE-2008-6709

Affected Products

Avaya Communication Manager

Avaya Sip Enablement Services

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-6709 · Security Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm · Vendor Advisory
• http://securityfocus.com/bid/29939 · Note
• http://osvdb.org/46603 · Note
• http://voipshield.com/research-details.php?id=78 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43380 · Note
• http://vupen.com/english/advisories/2008/1943/references · Note
• http://secunia.com/advisories/30751 · Note