Description
By exploiting misconfigurations in the web server on the Communication Manager it is possible to retrieve information or files which an unauthenticated user should not be able to. There are four instances of this vulnerability: Unauthenticated access to configuration files Unauthenticated access to log files Unauthenticated access to binary image files Unauthenticated access to help files
Recommendations
Avaya has acknowledged the issue and is working on correcting it. More details could be found in Avaya Security Advisory ASA-2008-394 at http://support.avaya.com/elmodocs2/security/ASA-2008-394.htm . In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Therefore it is recommended that only authorized systems and users be allowed to connect to the administration interface and to the system via a remote access mechanism such as SSH. Avaya customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.