CVE-2008-6573: SQL Injection
First published: Wed Apr 01 2009(Updated: )
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Avaya Aura Communication Manager | <=3.1 | |
| Avaya Aura Communication Manager | =3.1.1 | |
| Avaya Aura Communication Manager | =3.1.2 | |
| Avaya Aura Communication Manager | =3.1.3 | |
| Avaya Aura Communication Manager | =3.1.4 | |
| Avaya Aura Communication Manager | =3.1.4-sp1 | |
| Avaya Aura Communication Manager | =3.1.4-sp2 | |
| Avaya Aura Communication Manager | =3.1.5 | |
| Avaya Aura Communication Manager | =3.1.5-sp0 | |
| Avaya Aura Communication Manager | =4.0 | |
| Avaya Aura Communication Manager | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/28682
- http://www.voipshield.com/research-details.php?id=26
- http://support.avaya.com/elmodocs2/security/ASA-2008-150.htm
- http://secunia.com/advisories/29744
- http://support.avaya.com/elmodocs2/security/ASA-2008-151.htm
- http://www.voipshield.com/research-details.php?id=25
- http://www.voipshield.com/research-details.php?id=22
- http://osvdb.org/44285
- http://osvdb.org/44284
- http://osvdb.org/44286
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41733
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41730
Frequently Asked Questions
What is the severity of CVE-2008-6573?
CVE-2008-6573 is classified as a critical vulnerability due to its potential for remote SQL injection attacks that can lead to unauthorized access and data manipulation.
How do I fix CVE-2008-6573?
To mitigate CVE-2008-6573, it is recommended to update Avaya Communication Manager to the latest version that includes security patches addressing this vulnerability.
What types of attacks can CVE-2008-6573 enable?
CVE-2008-6573 can enable remote attackers to execute arbitrary SQL commands, potentially leading to data corruption or unauthorized access to sensitive information.
Which versions of Avaya Communication Manager are affected by CVE-2008-6573?
CVE-2008-6573 affects multiple versions of Avaya Communication Manager, including 3.x, 4.0, and 5.0.
Are there any known exploits for CVE-2008-6573?
Yes, there are known exploits for CVE-2008-6573 that leverage the SQL injection vulnerabilities in the affected Avaya systems.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/avaya
- canonical/avaya aura communication manager
- version/avaya aura communication manager/3.1
- version/avaya aura communication manager/3.1.1
- version/avaya aura communication manager/3.1.2
- version/avaya aura communication manager/3.1.3
- version/avaya aura communication manager/3.1.4
- version/avaya aura communication manager/3.1.4-sp1
- version/avaya aura communication manager/3.1.4-sp2
- version/avaya aura communication manager/3.1.5
- version/avaya aura communication manager/3.1.5-sp0
- version/avaya aura communication manager/4.0
- version/avaya aura communication manager/5.0