Some vulnerabilities have been reported in Avaya Message Storage Server, which can be exploited by malicious users to compromise a vulnerable system.

Multiple input validation errors in the web management interface can be exploited to execute arbitrary code on an affected system.

Successful exploitation requires valid user credentials to the web management interface.

The vulnerabilities are reported in version 3.x and 4.0.

Solution
The vendor recommends that local and network access to the affected systems be restricted until an update is available.
Further details available to Secunia VIM customers

Provided and/or discovered by
VoIPshield

Changelog
Further details available to Secunia VIM customers

Original Advisory
Avaya:
http://support.avaya.com/elmodocs2/security/ASA-2008-269.htm

VoIPshield:
http://www.voipshield.com/research-details.php?id=92
http://www.voipshield.com/research-details.php?id=93
http://www.voipshield.com/research-details.php?id=94
http://www.voipshield.com/research-details.php?id=95
http://www.voipshield.com/research-details.php?id=96
http://www.voipshield.com/research-details.php?id=97
http://www.voipshield.com/research-details.php?id=98
http://www.voipshield.com/research-details.php?id=99
http://www.voipshield.com/research-details.php?id=100
http://www.voipshield.com/research-details.php?id=101
http://www.voipshield.com/research-details.php?id=102
http://www.voipshield.com/research-details.php?id=103
http://www.voipshield.com/research-details.php?id=104

Deep Links
Links available to Secunia VIM customers