-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0803
 Avaya CMS Oracle Solaris "apr_fnmatch()" Denial of Service Vulnerability
                              23 August 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Avaya CMS
Publisher:         Avaya
Operating System:  Solaris
                   Network Appliance
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2011-0419  

Reference:         ASB-2012.0103
                   ESB-2012.0377
                   ESB-2011.1104
                   ESB-2011.1034
                   ESB-2011.0984.2
                   ESB-2011.0919.3
                   ESB-2011.0668
                   ESB-2011.0583
                   ESB-2011.0552
                   ESB-2011.0524.2
                   ESB-2011.0523

Original Bulletin: 
   https://downloads.avaya.com/css/P8/documents/100165695

- --------------------------BEGIN INCLUDED TEXT--------------------

Oracle Solaris Critical Update CVE-2011-0419

Original Release Date: August 20, 2012
Last Revised: August 20, 2012
Number: ASA-2012-332
Risk Level: High
Advisory Version: 1.0
Advisory Status: Interim

1. Overview:

New Critical Patch Updates or Security Alerts have been issued by Oracle on 
Oracle's Critical Patch Updates and Security Alerts website. Specific updates 
or alerts pertaining to this advisory are described below. The Oracle Advisory 
covering content outlined in this Avaya Security Advisory may be found in 
Oracle's Critical Patch Update Advisory - July 2012 and contains the following 
security issues.

Vulnerability in the Solaris component of Oracle Sun Products Suite 
(subcomponent: Library/libc). Supported versions that are affected are 9 and 
10. Difficult to exploit vulnerability allows successful unauthenticated 
network attacks via TCP/IP. Successful attack of this vulnerability can result 
in unauthorized ability to cause a partial denial of service (partial DOS) of 
Solaris. The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
assigned the name CVE-2011-0419 to this issue.

2. Avaya System Products using a Solaris Operating System:

Some Avaya system products are delivered with a Solaris Operating System. 
Actions to be taken on these products are described below.

Product:    Affected Version(s):  Risk Level:	Actions:
Avaya CMS   R15, R16, R16.1, 	  High		For CMS R15, upgrade to 
	    R16.2, R16.3	  		R15auxab.m, R15ab.m or later.
						For CMS R16.x, upgrade to 
						R16.3eg.b or later.
Avaya IR    4.x			  High		This issue will be addressed 
						in accordance with section 
						five of Avaya's Product 
						Security Vulnerability 
						Response Policy

Recommended Actions:
Avaya strongly recommends that customers follow networking and security best 
practices by implementing firewalls, ACLs, physical security or other 
appropriate access restrictions. Though Avaya believes such restrictions 
should always be in place, risk to Avaya products and the surrounding network 
from this potential vulnerability may be mitigated by ensuring these practices 
are implemented until such time as an Avaya provided product update or the 
recommended Avaya action is applied. Further restrictions as deemed necessary 
based on the customer's security policies may be required during this interim 
period, but customers should not modify the System Product operating system or 
application unless the change is approved by Avaya. Making changes that are 
not approved may void the Avaya product service contract.

Mitigating Factors:

When determining risk, Avaya takes into account many factors as outlined by 
Avaya's Security Vulnerability Classification Policy. The following table 
describes factors that mitigate the risk of specific vulnerabilities for 
affected Avaya products:

Vulnerability	Mitigating Factors
CVE-2011-0419	This is a high risk due to the potential for an 
		unauthenticated Denial of Service.

3. Additional Information:

Additional information may also be available via the Avaya support website and 
through your Avaya account representative. Please contact your Avaya product 
support representative, or dial 1-800-242-2121, with any questions.

4. Disclaimer:

ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS 
PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND 
AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL 
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND 
FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS 
RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. 
IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR 
IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, 
INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS 
OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE 
POSSIBILITY OF SUCH DAMAGES.

THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE 
FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER 
EXISTING AGREEMENTS WITH AVAYA.

5. Revision History:

V 1.0 - August 20, 2012 - Initial Statement issued.

Send information regarding any discovered security problems with Avaya 
products to either the contact noted in the product's documentation or 
securityalerts@avaya.com.

© 2012 Avaya Inc. All Rights Reserved. All trademarks identifying Avaya 
products by the ® or ™ are registered trademarks or trademarks, respectively, 
of Avaya Inc. All other trademarks are the property of their respective owners.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUDWLO+4yVqjM2NGpAQJ27A/9GDqhrXoY2W2M+MgQjaz7Dmvur0FaPXsE
xN289xTOqmbQ3FwzNSJb9pqP9eiETssiE/9hNnsYUcCr5VSV0p2+t3c73Kcj38zc
Y7GULbF5RKXzkcUGJMG86g4VIeAJfyg4sec1VhFvNtm6ctwOYTvQhmjWHYehFidm
BazY0bOsJBy/KiW+KN3bEPfRvT+riTmMhWtWbdY05asGHzn4eKGjhVm+vLlAzm3m
unZ2G5xL1ojlE8lZ6iZK0L4nNkH7np90TNF9J7GtDKZ1zi+THGiSujcPoQdTWwkZ
rcSJW9mtfvJasEmJFlD8eoAcuYuPWyu+oAahjxsLmh7wzRJJwKyK+BOOBMC4AoAa
IncTxISSZF8tNCfVTcTbxxN9dsIQLgBARmBhbox3uQsJ0FDHl7rfGpS8HfC1Jijs
xuNNNHimN3MPMbNTvas9Djcj7DVbW1Pbn4jW+3xHuj1rVW5FeIn3FsHgnVnImA4V
Cdfkm+bRKA1bzOSgR7jgjI0NWzsG+eRzEgaFcce1PwjV+fEDxTBH8FUTPxYIKgSn
3hHkn9qtmkxK5sgcHqotAop0VdKZBPRsPZKdG7XDJC6Baxm8lTCezeLfTETGSBSr
NRwakrgJ0oYDZpSlKi9r84iPdoCj6ExSPQUASTTH+F0nS+vD0ybXXnESeLNjlquP
1MlgIrk6FQM=
=51AT
-----END PGP SIGNATURE-----