Description
The Avaya SIP Enablement Service (SES) web administration interface allows authenticated users to configure a wide variety of system parameters. Due to the website configuration it is possible to retrieve certain system utilities. In this case the certificate installation utility is available without any authentication being required, exposing file system information.
Recommendations
To completely address the issue requires a patch from Avaya. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Therefore it is recommended that only authorized systems and users be allowed to connect to the administration interface and to the system via a remote access mechanism such as SSH. Administrators with root access to the system may wish to temporarily disable this function in order to prevent it from being exploited. However, implementing this workaround may affect your ability to obtain support from Avaya. Avaya customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.