|
 |
|
Avaya Multiple Products H.323 Protocol Implementation Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA10667
|
|
|
Release Date:
|
2004-01-20
|
|
Last Update:
|
2005-01-28
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Avaya VPNos 4.x (for Security Gateways)
|
| | Software: | DEFINITY Communications Servers 7.x
DEFINITY Communications Servers 8.x
S8100 Media Server
S8300 Media Server
S8500 Media Server
S8700 Media Server
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Avaya has acknowledged that some products are affected by the recently reported vulnerabilities in various vendors' H.323 protocol implementations.
The vulnerabilities are caused due to various errors in the processing of H.225 messages over TCP. This can be exploited by malicious people to crash or reboot an affected device by sending specially crafted messages to it (default port 1720/tcp). Some vulnerabilities can furthermore be exploited to compromise an affected Communication Manager server.
The following security products running VPNos 4.2, 4.3, or 4.31.29 with H.323 NAT capability enabled are affected:
* SG5/5X Security Gateways
* SG200 Security Gateway
* SG203/208 Security Gateways
The following Communication Manager servers are also affected:
* S8700 Media Servers
* S8500 Media Servers
* S8300 Media Servers
* S8100 Media Servers
* DEFINITY Server R
* DEFINITY Server SI/CSI
Solution:
The vulnerability has been fixed in VPNos 4.4 and updates have been issued for other products (see vendor advisory for more information).
Changelog:
2004-01-29: Added various Communication Manager servers as affected products.
2005-01-28: Updated advisory.
Original Advisory:
http://support.avaya.com/japple/css/j...teTransaction=avaya.css.UsageUpdate()
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
