Description
The Avaya Communication Manager (CM) web administration interface allows authenticated users to configure a wide variety of system parameters. The user which accesses the interface, while an administrator of the Avaya configuration, is not an administrator (e.g. root user) on the system itself. Standard Avaya administrator accounts authenticate to the system using regular password authentication, therefore they may also connect directly to the system and interact with the operating system as an unprivileged user. It is possible to exploit a flaw in the administration interface while configuring data viewing or restoring credentials to elevate the privileges of a basic administrator and have code executed as root.
Recommendations
To completely address the issue requires a patch from Avaya. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Therefore it is recommended that only authorized systems and users be allowed to connect to the administration interface and to the system via a remote access mechanism such as SSH. Administrators with root access to the system may wish to temporarily disable this function in order to prevent it from being exploited. However, implementing this workaround may affect your ability to obtain support from Avaya. Avaya customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.