Avaya one-X Communicator ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	47536
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 21 2011 12:00AM
Updated:	Apr 21 2011 12:00AM
Credit:	Avaya
Vulnerable:	Avaya one-X Communicator 6.0 Avaya one-X Communicator 5.2
Not Vulnerable:

Avaya one-X Communicator ActiveX Control Buffer Overflow Vulnerability

Avaya one-X Communicator is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. This issue affects an unspecified ActiveX control.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts likely result in denial-of-service conditions.

Avaya one-X Communicator ActiveX Control Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Avaya one-X Communicator ActiveX Control Buffer Overflow Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Avaya one-X Communicator ActiveX Control Buffer Overflow Vulnerability

References:

• Avaya Homepage (Avaya Inc.)
  
• Microsoft support document 240797 (Microsoft)
  
• one-X Communicator Buffer Overflow Vulnerability (Avaya)