Technical Description

A vulnerability has been identified in Avaya Call Management System (CMS) and Avaya Interactive Response (IR), which could be exploited by attackers to cause a denial of service. This issue is caused by an error in Solaris when handling self encapsulated IP packets, which could allow a remote privileged user to panic a vulnerable system, creating a denial of service condition. For additional information, see : VUPEN/ADV-2008-1192

Affected Products

Avaya Call Management System (CMS) R12
Avaya Call Management System (CMS) R13
Avaya Call Management System (CMS) R13.1
Avaya Interactive Response (IR) 2.0
Avaya Interactive Response (IR) 3.0

Solution

Restrict local and network access to the server.

Apply patch for Avaya IR :
http://support.avaya.com/elmodocs2/security/ASA-2008-173.htm

References

http://www.vupen.com/english/advisories/2008/1325
http://support.avaya.com/elmodocs2/security/ASA-2008-173.htm

ChangeLog

2008-04-23 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.