ID
VAR-200909-0577
TITLE
Avaya Intuity Audix LX Multiple Input Validation Vulnerabilities
Trust: 0.6
DESCRIPTION
Intuity Audix LX is a powerful multimedia messaging server. Multiple CGI perl scripts in the /html/cswebadm/basic/cgibin/ directory of Intuity Audix LX do not properly validate user-submitted parameter requests, and remote attackers can execute arbitrary code by submitting HTTP POST requests; The url parameter of /cgi-bin/smallmenu.pl may cause cross-site scripting attacks; the use of tokenization protection management changes when logging into the web interface may result in cross-site request forgery attacks. Avaya Intuity Audix LX is prone to multiple remote vulnerabilities, including: 1. Multiple remote command-execution vulnerabilities 2. A cross-site request-forgery vulnerability 3. A cross-site scripting vulnerability Attackers can exploit these issues to execute arbitrary commands with the privileges of 'vexvm' on the underlying system, steal cookie-based authentication credentials, execute arbitrary script code, and perform administrative tasks. Other attacks are also possible
Trust: 0.81
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | no | model: | - | scope: | - | version: | - | Trust: 0.6 |
| vendor: | avaya | model: | intuity audix lx r1.1 | scope: | - | version: | - | Trust: 0.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||
|
|
THREAT TYPE
network
Trust: 0.3
TYPE
Input Validation Error
Trust: 0.3
EXTERNAL IDS
| db: | BID | id: | 36450 | Trust: 0.9 |
| db: | CNVD | id: | CNVD-2009-5003 | Trust: 0.6 |
REFERENCES
| url: | http://www.gnucitizen.org/static/blog/2009/09/avaya_intuity_remote_command_execution.pdf | Trust: 0.9 |
| url: | http://support.avaya.com/japple/css/japple?page=product&temp.productid=136319 | Trust: 0.3 |
CREDITS
Adrian 'pagvac' Pastor
Trust: 0.3
SOURCES
| db: | CNVD | id: | CNVD-2009-5003 |
| db: | BID | id: | 36450 |
LAST UPDATE DATE
2022-05-17T01:41:45.787000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2009-5003 | date: | 2014-02-11T00:00:00 |
| db: | BID | id: | 36450 | date: | 2011-01-05T21:12:00 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2009-5003 | date: | 2009-09-18T00:00:00 |
| db: | BID | id: | 36450 | date: | 2009-09-18T00:00:00 |