Avaya Intuity Audix LX Multiple Remote Vulnerabilities

Bugtraq ID:	36450
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 18 2009 12:00AM
Updated:	Jan 05 2011 09:12PM
Credit:	Adrian 'pagvac' Pastor
Vulnerable:	Avaya Intuity AUDIX LX R1.1
Not Vulnerable:

Avaya Intuity Audix LX Multiple Remote Vulnerabilities

Avaya Intuity Audix LX is prone to multiple remote vulnerabilities, including:

1. Multiple remote command-execution vulnerabilities
2. A cross-site request-forgery vulnerability
3. A cross-site scripting vulnerability

Attackers can exploit these issues to execute arbitrary commands with the privileges of 'vexvm' on the underlying system, steal cookie-based authentication credentials, execute arbitrary script code, and perform administrative tasks. Other attacks are also possible.

Avaya Intuity Audix LX Multiple Remote Vulnerabilities

The following example URI and data are available:

• /data/vulnerabilities/exploits/36450.txt

Avaya Intuity Audix LX Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Avaya Intuity Audix LX Multiple Remote Vulnerabilities

References:

• Avaya Intuity Audix LX Multiple Remote Vulnerabilities (Adrian 'pagvac' Pastor)
  
• Intuity Audix LX Homepage (Avaya)