Avaya One-X Desktop Edition Phone SIP Remote Buffer Overflow Vulnerability

Bugtraq ID:	24530
Class:	Boundary Condition Error
CVE:	CVE-2007-3318
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Sipera VIPER Lab is credited with the discovery of this issue.
Vulnerable:	Avaya one-X Desktop Edition 2.1 .70
Not Vulnerable:

Avaya One-X Desktop Edition Phone SIP Remote Buffer Overflow Vulnerability

Avaya one-X Desktop Edition phone is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to disable the call-receiving functionality of affected phones.

Avaya one-X Desktop Edition 2.1.0.70 and prior versions are vulnerable.

Avaya One-X Desktop Edition Phone SIP Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Avaya One-X Desktop Edition Phone SIP Remote Buffer Overflow Vulnerability

Solution:
The vendor has released a patch to address this issue. Please see the referenced advisory for more information.

Avaya One-X Desktop Edition Phone SIP Remote Buffer Overflow Vulnerability

References:

• Avaya Homepage (Avaya Inc.)
  
• ASA-2007-241: Vulnerabilities in Avaya One-X Desktop Edition ® SIP UAC (Avaya)
  
• Buffer overflow vulnerability in Avaya one-X Desktop Edition may allow an attack (Sipera Systems)