Secunia

Avaya has confirmed an old vulnerability in ncompress, which is included in various products. This can potentially be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to boundary errors within the handling of command line options in "compress" and "uncompress". This can be exploited to cause a buffer overflow by supplying e.g. a specially crafted, overly long filename.

Successful exploitation can lead to execution of arbitrary code in context of the process using the ncompress utility.

NOTE: The vendor states that ncompress is not used by any applications or network services.

The following products are affected:
* Avaya S8710/S8700/S8500/S8300 (all versions)
* Avaya Converged Communication Server (all versions)
* Avaya Network Routing (all versions)

Solution
The vendor recommends restricting local access to the server.
Original Advisory
Avaya:
http://support.avaya.com/elmodocs2/security/ASA-2005-015_RHSA-2004-536.pdf

Deep Links
Links available in Customer Area