CVE-2008-6706: High severity avaya aura sip enablement services vulnerability
Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allow remote attackers to obtain (1) application server configuration, (2) database server configuration including encrypted passwords, (3) a system utility that decrypts "subscriber table passwords," (4) a system utility that decrypts database passwords, and (5) a system utility that encrypts "subscriber table passwords."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6706?
CVE-2008-6706 is classified as a high severity vulnerability due to its potential impact on sensitive configuration and database information.
How do I fix CVE-2008-6706?
To remediate CVE-2008-6706, users should apply the latest security patches and updates provided by Avaya for affected versions of their software.
What systems are affected by CVE-2008-6706?
CVE-2008-6706 affects multiple versions of Avaya SIP Enablement Services 3.x and 4.0, as well as Avaya Communication Manager 3.1.x.
What kind of information can be exposed due to CVE-2008-6706?
CVE-2008-6706 can allow remote attackers to obtain sensitive application server and database server configurations, including encrypted passwords.
Is there a workaround for CVE-2008-6706?
A feasible workaround for CVE-2008-6706 may include restricting access to the web management interface to trusted IP addresses.