Title: Avaya SES Authentication Bypass Vulnerability and Information Disclosure Weakness
Severity: MODERATE
Description:
SIP Enablement Services server is a Session Initiation Protocol (SIP) management application for SIP routers produced by Avaya.
The application is prone to an authentication-bypass vulnerability because it fails to protect access to the router's system-update section of the interface. This may allow unauthenticated remote attackers to initiate a router update.
The application is also prone to an information-disclosure weakness caused by a flaw in the way SES handles alarms caused by remote-management login failures. When a failure occurs, both the username and password are written to the alarm and system log files in plain text.
Attackers can exploit the authentication-bypass issue to render the server unusable for a period. Exploiting the information-disclosure weakness may give the attacker unauthorized access to login credentials.
Avaya SES 5.0 and CM 5.0 on S8300C with SES enabled are vulnerable; other versions may also be affected.
Affected Products:
- Avaya S8300C CM 5
- Avaya SES 5.0