-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2008.0254                  AUSCERT Advisory

                               [UNIX/Linux]
      A vulnerability has been identified in Avaya Products Net-SNMP
                             12 December 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Avaya AES
                      Avaya Communication Manager
                      Avaya Intuity AUDIX LX
                      Avaya EMMC
                      Avaya Messaging Storage Server
                      Avaya Message Networking
                      Avaya SIP Enablement Services
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-4309
Member content until: Friday, January 09 2009

Ref:                  ESB-2008.1016

OVERVIEW:

      A vulnerability has been identified in Avaya Products Net-SNMP.  


IMPACT:

      This vulnerability can cause a denial of service as a result of the
      way that Net-SNMP processes SNMP GETBULK requests. It is possible
      to crash the server via a specially-crafted request. [1]


MITIGATION:

      As no update is currently available, the vendor recommends that
      "... customers restrict local and network access to the server." [1]


REFERENCES:

      [1] ASA-2008-467 (RHSA-2008-0971)
          http://support.avaya.com/elmodocs2/security/ASA-2008-467.htm

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSUHFxSh9+71yA2DNAQIymgP8Dn3vYQtfgn4fuPi0birPivUbQiRO+aAX
21J33WPG8xjTdZBh/F+zawM+2i+NBLIkWgmTv+bur+ybiJH1M2iz6EKDeTET0Fc6
cWo+fZq5hw5XprP9K6KUBwcizQhxPxfdWHdhWK/4wLvggw7nsKTmPMNi02FveqTl
+MQ6VroAznI=
=vruj
-----END PGP SIGNATURE-----