CERTA-2012-AVI-734
Vulnerability from certfr_avis

Une vulnérabilité a été corrigée dans les produits Avaya. Elle concerne des débordements d'entiers dans les fonctions strtod(), strtof() et strtold() pouvant mener à des débordement de tampon en mémoire. Un utilisateur malintentionné peut ainsi exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
AVAYA N/A Avaya Aura Application Server 5300 versions 2.x et 3.x
AVAYA N/A Avaya Aura Messaging version 6.x
AVAYA N/A Avaya Aura Application Enablement Services versions 5.x et 6.x
AVAYA N/A Avaya IP Office Application Server version 8.x
AVAYA N/A Avaya Proactive Contact version 5.x
AVAYA N/A Avaya Communication Server 1000 versions 6.x et 7.x
AVAYA N/A Avaya Aura Session Manager versions 1.x, 5.x, 6.1.x, 6.2 à 6.2.2
AVAYA N/A Avaya Aura Communication Manager version 6.x
AVAYA N/A Avaya Voice Portal version 5.x
AVAYA N/A Avaya Aura Presence Services version 6.x
AVAYA N/A Avaya Aura System Manager versions 5.x, 6.1.x et 6.2.x
AVAYA N/A Avaya Aura System Platform versions 1.x et 6.x
AVAYA N/A Avaya one-X Client Enablement Services version 6.x
AVAYA N/A Avaya Aura Conferencing Standard Edition version 6.x
AVAYA N/A Avaya IQ version 5.x
AVAYA N/A Avaya Aura Communication Manager Utility Services version 6.x
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Avaya Aura Application Server 5300 versions 2.x et 3.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Messaging version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Application Enablement Services versions 5.x et 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya IP Office Application Server version 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Proactive Contact version 5.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Communication Server 1000 versions 6.x et 7.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Session Manager versions 1.x, 5.x, 6.1.x, 6.2 \u00e0 6.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Communication Manager version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Voice Portal version 5.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Presence Services version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura System Manager versions 5.x, 6.1.x et 6.2.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura System Platform versions 1.x et 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya one-X Client Enablement Services version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Conferencing Standard Edition version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya IQ version 5.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    },
    {
      "description": "Avaya Aura Communication Manager Utility Services version 6.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "AVAYA",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-3480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3480"
    }
  ],
  "initial_release_date": "2012-12-13T00:00:00",
  "last_revision_date": "2012-12-13T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-734",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans les produits \u003cspan\nclass=\"textit\"\u003eAvaya\u003c/span\u003e. Elle concerne des d\u00e9bordements d\u0027entiers\ndans les fonctions \u003cspan class=\"textit\"\u003estrtod()\u003c/span\u003e, \u003cspan\nclass=\"textit\"\u003estrtof()\u003c/span\u003e et \u003cspan class=\"textit\"\u003estrtold()\u003c/span\u003e\npouvant mener \u00e0 des d\u00e9bordement de tampon en m\u00e9moire. Un utilisateur\nmalintentionn\u00e9 peut ainsi ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Avaya",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Avaya 100167371 du 10 d\u00e9cembre 2012",
      "url": "https://downloads.avaya.com/css/P8/documents/100167371"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.