|
Avaya Multiple Products H.323 Protocol Implementation Vulnerabilities
|
|
Secunia Advisory:
|
SA10667
|
|
|
Release Date:
|
2004-01-20
|
|
Last Update:
|
2005-01-28
|
|
Popularity:
|
6,718 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Avaya VPNos 4.x (for Security Gateways)
|
|
| Software: | DEFINITY Communications Servers 7.x
DEFINITY Communications Servers 8.x
S8100 Media Server
S8300 Media Server
S8500 Media Server
S8700 Media Server
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Avaya has acknowledged that some products are affected by the recently reported vulnerabilities in various vendors' H.323 protocol implementations.
The vulnerabilities are caused due to various errors in the processing of H.225 messages over TCP. This can be exploited by malicious people to crash or reboot an affected device by sending specially crafted messages to it (default port 1720/tcp). Some vulnerabilities can furthermore be exploited to compromise an affected Communication Manager server.
The following security products running VPNos 4.2, 4.3, or 4.31.29 with H.323 NAT capability enabled are affected:
* SG5/5X Security Gateways
* SG200 Security Gateway
* SG203/208 Security Gateways
The following Communication Manager servers are also affected:
* S8700 Media Servers
* S8500 Media Servers
* S8300 Media Servers
* S8100 Media Servers
* DEFINITY Server R
* DEFINITY Server SI/CSI
Solution:
The vulnerability has been fixed in VPNos 4.4 and updates have been issued for other products (see vendor advisory for more information).
Changelog:
2004-01-29: Added various Communication Manager servers as affected products.
2005-01-28: Updated advisory.
Original Advisory:
http://support.avaya.com/japple/css/j...teTransaction=avaya.css.UsageUpdate()
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
