Avaya has acknowledged multiple vulnerabilities in various products, which potentially can be exploited to gain unauthorised access to other websites, bypass certain security restrictions, or gain escalated privileges.

1) A vulnerability in glibc can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges.

For more information:
SA12930

This vulnerability affects the following products:
* Avaya S8710/S8700/S8500/S8300 (All versions)
* Avaya Converged Communication Server (All versions)
* Avaya MN100 (All versions)
* Avaya Intuity LX (1.1-5.x)
* Avaya Modular Messaging (All versions)
* Avaya Network Routing (All versions)

2) Various vulnerabilities in Apache and mod_ssl can be exploited to gain escalated privileges, unauthorised access to web sites, or bypass certain security restrictions.

For more information:
SA10789
SA12787
SA12898

These vulnerabilities affect the following products:
* Avaya MN100 (All versions)
* Avaya Intuity LX (1.1-5.x)
* Avaya Modular Messaging MSS (All versions)
* Avaya Network Routing (All versions)
* Avaya Communication Manager (All versions)

Solution
The vendor recommends that traffic is filtered to the affected services and only trusted users are granted local access.
Changelog
Further details available to Secunia VIM customers

Original Advisory
Avaya:
http://support.avaya.com/elmodocs2/security/ASA-2005-011_RHSA-2004-586.pdf
http://support.avaya.com/elmodocs2/security/ASA-2005-010_RHSA-2004-600.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers