Description
The Avaya Messaging Storage Server (MSS) Messaging Administration interface allows authenticated users to configure a wide variety of system parameters. The user which accesses the interface, while an administrator of the Avaya configuration, is not an administrator on the system itself. It is possible to exploit a total of three separate flaws in the administration interface while adding or changing external hosts to execute arbitrary system commands as the user “vexvm”.
Recommendations
To completely address the issue requires a patch from Avaya. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Therefore it is recommended that only authorized systems and users be allowed to connect to the administration interface and to the system via a remote access mechanism such as SSH. Administrators with root access to the system may wish to temporarily disable this function in order to prevent it from being exploited. However, implementing this workaround may affect your ability to obtain support from Avaya. Avaya customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.