bugtraq - Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 18 Sep 2009 09:10:07 +0100
From: Adrian P <unknown.pentester@...il.com>
To: bugtraq@...urityfocus.com
Subject: Multiple Remote Command Execution vulnerabilities on Avaya Intuity 
	Audix LX (plus some client-side bugs)

It appears that most diagnostic CGI perl scripts that take
user-supplied input are vulnerable to Remote Command Execution. These
scripts are located on '/html/cswebadm/basic/cgi-bin/'. All the RCE
vulnerabilities discovered were tested with an authenticated session
using the 'craft' account. These vulnerabilities might also be
exploitable by less-privileged accounts, but this has NOT been tested.

The web interface of Avaya Intuity AUDIX LX is also vulnerable to XSS
and CSRF which can be used in conjunction with the RCE vulnerabilities
in different exploitation scenarios.

Successfully tested on: Avaya IntuityTM AUDIX LX R1.1. Other versions
might also be affected. Avaya has stated that IALX 1.1, which was
discontinued in 2007, is the latest vulnerable version. IALX 2.0 SP2
is not vulnerable according to Avaya.

Complete technical details can be found in the following document:

http://www.gnucitizen.org/static/blog/2009/09/Avaya_Intuity_Remote_Command_Execution.pdf

-- 
pagvac | GNUCITIZEN.org