CVE-2017-11309 : Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allow

Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long response.

Published 2017-11-10 02:29:17

Updated 2019-05-01 15:15:11

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2017-11309

Avaya » Ip Office
Versions before (<) 10.1.1
cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

29.58%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.6	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	2.8	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

http://packetstormsecurity.com/files/144883/Avaya-IP-Office-IPO-10.1-Soft-Console-Remote-Buffer-Overflow.html

Avaya IP Office (IPO) 10.1 Soft Console Remote Buffer Overflow ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://downloads.avaya.com/css/P8/documents/101044086

ASA-2017-307
Vendor Advisory
http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-SOFT-CONSOLE-REMOTE-BUFFER-OVERFLOW-0DAY.txt

Exploit;Third Party Advisory
http://www.securityfocus.com/bid/101674

Avaya IP Office Contact Center CVE-2017-11309 Remote Buffer Overflow Vulnerability
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/43121/

Avaya IP Office (IPO) < 10.1 - 'SoftConsole' Remote Buffer Overflow (SEH)
Exploit;Third Party Advisory;VDB Entry

Jump to