Abdul-Aziz Hariri has discovered multiple vulnerabilities in Avaya WinPDM, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the Unite Host Router service (UniteHostRouter.exe) when processing certain requests can be exploited to cause a stack-based buffer overflow via an overly long string in the "To:" field sent to UDP port 3217.

2) A boundary error in UspCsi.exe when processing certain requests can be exploited to cause a heap-based buffer overflow via a specially crafted overly long string sent to UDP port 10136.

Successful exploitation of these vulnerabilities allows execution of arbitrary code.

3) A boundary error in CuspSerialCsi.exe when processing certain requests can be exploited to cause a heap-based buffer overflow via a specially crafted overly long string sent to UDP port 10158.

4) A boundary error in MwpCsi.exe when processing certain requests can be exploited to cause a heap-based buffer overflow via a specially crafted overly long string sent to UDP port 10137.

5) A boundary error in PMServer.exe when processing certain requests can be exploited to cause a heap-based buffer overflow via a specially crafted overly long string sent to UDP port 10138.

Successful exploitation of vulnerabilities #3 through #5 may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 3.8.5 (confirmed in 3.8.2).

Solution
Update to version 3.8.5.

Provided and/or discovered by
Abdul-Aziz Hariri via Secunia

Original Advisory
Avaya (ASA-2011-143):
https://support.avaya.com/css/P8/documents/100140122

Deep Links
Links available in Customer Area