Avaya has acknowledged a weakness in various Avaya products, which can be exploited by malicious people to spoof emails.

The weakness is caused due to the configuration of sendmail not rejecting the "localhost.localdomain" domain name for email coming from external hosts. This can be exploited to spoof emails.

The following products are affected:
* Avaya Communication Manager (CM 2.x and CM 3.0)
* Avaya Messaging Storage Server (MSS 3.x)
* Avaya Message Networking (all versions)
* Avaya CCS/SES (3.0 or earlier)

Solution
Avaya Communication Manager:
Further details available to Secunia VIM customers

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers