PT-2012-2074 · Avaya · Avaya Aura Application Server 5300

Abdulaziz Hariri · Published 2012-07-03 · Updated 2012-07-17 · CVE-2011-5096

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya Aura Application Server 5300 versions 1.x before 1.0.2 Avaya Aura Application Server 5300 version 2.0 before Patch Bundle 10

Description The issue is related to a stack-based buffer overflow in the cstore.exe component of the Media Application Server. This can be exploited by remote attackers to execute arbitrary code. The exploitation occurs via a crafted cs anams parameter in a "CONTENT STORE ADMIN REQ" packet.

Recommendations For Avaya Aura Application Server 5300 versions 1.x before 1.0.2, update to version 1.0.2 or later. For Avaya Aura Application Server 5300 version 2.0, apply Patch Bundle 10 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2011-5096

Affected Products

Avaya Aura Application Server 5300

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-5096 · Security Note
• https://downloads.avaya.com/css/P8/documents/100146108 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-11-260 · Note