Microsoft issued a security bulletin summary for November 2006 which contained six security advisories: MS06-066, MS06-067, MS06-068, MS06-069, MS06-070 and MS06-071. The advisories describe vulnerabilities in various Microsoft Windows Operating Systems. A description of the vulnerabilities can be found at: :
Certain Avaya products utilize Microsoft Operating Systems and may be affected by these vulnerabilities.
Avaya system products include an Operating System with the product when it is delivered. The system products described below are delivered with a Microsoft Operating System. Actions to be taken with these products are also described below.
| Product: | Affected Version(s): | Risk Level: | Actions: |
|---|---|---|---|
| Avaya S8100 | All | High | Follow Microsoft's recommendation for installing the Operating
System patches: MS06-066 MS06-067 MS06-068 MS06-070 MS06-071 These products are deployed with either the Microsoft Windows 2000 Operating System or the Microsoft Windows NT Operating System. |
| Avaya Messaging Application Server | All | High | Follow Microsoft's recommendation for installing the Operating
System patches: MS06-066 MS06-067 MS06-068 MS06-070 MS06-071 This product is deployed with either the Microsoft Windows 2000 Operating System or the Microsoft Windows 2003 Operating System. |
Recommended Actions:
Install all available security updates as provided via Microsoft Windows Update.
Avaya software-only products operate on general-purpose operating systems. Occasionally vulnerabilities may be discovered in the underlying operating system or applications that come with the operating system. These vulnerabilities often do not impact the software-only product directly but may threaten the integrity of the underlying platform.
In the case of this advisory Avaya software-only products are not affected by the vulnerability directly but the underlying Microsoft Windows platform may be. For affected Microsoft Operating Systems, Microsoft recommends installing patches. Detailed instructions for patching the Operating System are given by Microsoft at the following links:
| Product: | Software Version(s): |
|---|---|
| Avaya Agent Access | All Versions |
| Avaya Basic Call Management System Reporting Desktop - server | All Versions |
| Avaya Basic Call Management System Reporting Desktop - client | All Versions |
| Avaya CMS Supervisor | All Versions |
| Avaya Computer Telephony | All Versions |
| Avaya Contact Center Express (ACCE) | All Versions |
| Avaya CVLAN Client | All Versions |
| Avaya Enterprise Manager | All Versions |
| Avaya Integrated Management | All Versions |
| Avaya Interaction Center (IC) | All Versions |
| Avaya Interaction Center - Voice Quick Start | All Versions |
| Avaya IP Agent | All Versions |
| Avaya IP Softphone | All Versions |
| Avaya Modular Messaging | All Versions |
| Avaya Network Reporting | All Versions |
| Avaya OctelAccess(r) Server | All Versions |
| Avaya OctelDesignerTM | All Versions |
| Avaya Operational Analyst | All Versions |
| Avaya Outbound Contact Management | All Versions |
| Avaya Speech Access | All Versions |
| Avaya Unified Communication Center (UCC) | All Versions |
| Avaya Unified Messenger (r) | All Versions |
| Avaya Visual Messenger TM | All Versions |
| Avaya Visual Vector Client | All Versions |
| Avaya VPNmanagerTM Console | All Versions |
| Avaya Web Messenger | All Versions |
Recommended Actions:
Install all available security updates as provided via Microsoft Windows Update.
MS06-066 Vulnerabilities in Client Service for NetWare Could Allow Remote Code Execution (923980) Vulnerabilities in Microsoft Client Service could allow remote code execution. The Avaya S8100 and the Modular Messaging Message Application Server are affected by this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2006-4688 and CVE-2006-4689 to these issues.
MS06-067 Cumulative Security Update for Internet Explorer (922760): Several vulnerabilities have been reported in Microsoft Internet Explorer. The most severe of which could allow a remote attacker take complete control of an affected system. The Avaya S8100 and the Modular Messaging Message Application Server are affected by this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2006-4777, CVE-2006-4446, and CVE-2006-4687 to these issues.
MS06-068 Vulnerability in Microsoft Agent Could Allow Remote Code Execution (920213): A Vulnerability in Microsoft Agent could allow an attacker who successfully exploited this vulnerability to take complete control of an affected system. The Avaya S8100 the Modular Messaging Message Application Server are affected by this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2006-3445 to these issues.
MS06-069 Vulnerabilities in Macromedia Flash Player from Adobe Could Allow Remote Code Execution (923789): Several vulnerabilities in Macromedia Flash Player have been reported, the most severe of which could allow a remote attacker to take complete control of the affected system. No Avaya System products have Flash Player installed, and are therefore not vulnerable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2006-3014, CVE-2006-3311, CVE-2006-3587, CVE-2006-3588, and CVE-2006-4640 to these issues.
MS06-070 Vulnerability in Workstation Service Could Allow Remote Code Execution (924270) : A remote code execution vulnerability exists in the Workstation service that could allow an attacker who successfully exploited this vulnerability to take complete comtrol of the affected system. The Avaya S8100 and the Modular Messaging Message Application Server are affected by this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2006-4691 to this issue.
MS06-071 Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (928088): A vulnerability exists in the XMLHTTP ActiveX control within Microsoft XML Core Services that could allow for remote code execution. The Avaya S8100 and the Modular Messaging Message Application Server are affected by this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2006-5745 to this issue.
Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.
ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.
V 1.0 - November 20, 2006 - Initial Statement issued.
Send information regarding any discovered security problems with Avaya products to either the contact noted in the product's documentation or [email protected].
© 2006 Avaya Inc. All Rights Reserved. All trademarks identified by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.