Avaya has acknowledged multiple vulnerabilities in Avaya Call Management System, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and gain escalated privileges and by malicious people to disclose system information, cause a DoS (Denial of Service), and compromise a vulnerable system.

For more information:
SA42984

The vulnerabilities are reported in the following versions R15, R16, R16.1, and R16.2.

Solution
The vendor recommends that local and network access to the affected systems be restricted until an update is available.
Original Advisory
ASA-2011-041:
https://support.avaya.com/css/P8/documents/100128919

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers