Secunia Logo
Netsikker nu! 2008
 
Avaya Message Storage Server Input Validation Vulnerabilities
Secunia Advisory: SA30777
Release Date: 2008-06-27
Last Update: 2008-07-09
Popularity: 2,778 views

Critical:
Less critical
Impact: System access
Where: From remote
Solution Status: Unpatched

OS:Avaya Modular Messaging 3.x

Software:Avaya Modular Messaging 4.x

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference:CVE-2008-3081


Description:
Some vulnerabilities have been reported in Avaya Message Storage Server, which can be exploited by malicious users to compromise a vulnerable system.

Multiple input validation errors in the web management interface can be exploited to execute arbitrary code on an affected system.

Successful exploitation requires valid user credentials to the web management interface.

The vulnerabilities are reported in version 3.x and 4.0.

Solution:
The vendor recommends that local and network access to the affected systems be restricted until an update is available.

Provided and/or discovered by:
VoIPshield

Changelog:
2008-07-09: Added CVE reference.

Original Advisory:
Avaya:
http://support.avaya.com/elmodocs2/security/ASA-2008-269.htm

VoIPshield:
http://www.voipshield.com/research-details.php?id=92
http://www.voipshield.com/research-details.php?id=93
http://www.voipshield.com/research-details.php?id=94
http://www.voipshield.com/research-details.php?id=95
http://www.voipshield.com/research-details.php?id=96
http://www.voipshield.com/research-details.php?id=97
http://www.voipshield.com/research-details.php?id=98
http://www.voipshield.com/research-details.php?id=99
http://www.voipshield.com/research-details.php?id=100
http://www.voipshield.com/research-details.php?id=101
http://www.voipshield.com/research-details.php?id=102
http://www.voipshield.com/research-details.php?id=103
http://www.voipshield.com/research-details.php?id=104


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Trend Micro ServerProtect Multiple Buffer Overflow Vulnerabilities // 30 views
2. Subdreamer Light Global Variables SQL Injection Vulnerability // 29 views
3. Sun Java System Web Proxy Server FTP Subsystem Buffer Overflow // 26 views
4. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities // 25 views
5. CA ARCserve Backup Multiple Vulnerabilities // 24 views
6. Red Hat update for cups // 21 views
7. Gentoo Portage Insecure Python Module Search Path Security Issue // 19 views
8. Built2go Real Estate Listings "event_id" SQL Injection // 19 views
9. FUJITSU Interstage Products Apache Tomcat Security Bypass // 18 views
10. ScriptsEz Easy Image Downloader "id" File Disclosure Vulnerability // 18 views