----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
Avaya Various Products Information Disclosure

SECUNIA ADVISORY ID:
SA14197

VERIFY ADVISORY:
http://secunia.com/advisories/14197/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
Local system

SOFTWARE:
Avaya Softconsole 1.x
http://secunia.com/product/4764/
Avaya IP Softphone 5.x
http://secunia.com/product/4762/
Avaya IP Office 2.x
http://secunia.com/product/4765/
Avaya IP Agent 4.x
http://secunia.com/product/4763/
Avaya Interactive Response 1.x
http://secunia.com/product/4767/
Avaya Conversant / Interactive Voice Response
http://secunia.com/product/4768/
Avaya CMS Supervisor
http://secunia.com/product/4766/

DESCRIPTION:
Adrian Pastor has reported a security issue in various Avaya
products, which can be exploited by malicious, local users to gain
knowledge of sensitive information.

The issue is caused due to insecure storage of sensitive information
in various locations including application files and registry keys on
affected systems. This can be exploited to gain knowledge of various
user credentials and other unspecified application data.

The security issue affects the following products:
* Avaya IP Softphone (all versions)
* Avaya IP Agent (all versions)
* Avaya IP Softconsole (all versions)
* Avaya IP Office Phone Manager (all versions)
* Avaya IP Office TAPI (all versions)
* Avaya CMS Supervisor (all versions)
* Avaya Interactive Response (all versions)
* Avaya Conversant / Interactive Voice Response (all versions)

SOLUTION:
The vendor has the following recommendations:

IP Softphone, IP Agent, and IP Softconsole:
Don't use the "Remember password for next login session" option (see
vendor advisory for details).

All affected products:
Restrict access to affected systems and registry keys.

PROVIDED AND/OR DISCOVERED BY:
Adrian Pastor

ORIGINAL ADVISORY:
Avaya:
http://support.avaya.com/elmodocs2/security/ASA-2005-041_Sensitive_Info_Leak.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------