Avaya Security Advisory interpretation and classification

Precise definitions that theAvaya Product Security Support Team (PSST) follows in classifying vulnerabilities relative to their potential threat to Avaya products is in Avaya Security Vulnerability Classification document at http://support.avaya.com/elmodocs2/security/security_vulnerability_classification.pdf.

The following table summarizes the three main categories:

Table 1. Avaya security vulnerability classification
Vulnerability classification	Criteria for classification
High	The product is vulnerable to: Attacks from a remote unauthenticated user who: Can easily access high-level administrative control of a system or critical application without interaction with a user of the product beyond standard operating procedures. Attacks from remote unauthenticated user who: Can easily cause the system or a critical application to shutdown, reboot, or become unusable without requiring interaction with a product user. For example, see the advisory at http://support.avaya.com/elmodocs2/security/ASA-2006-002.htm.
Medium	The product does not meet criteria for high vulnerability, but is vulnerable to: Attack from a user who can access a user account, and access does not directly require the privileges of a high-level administrative account. The system and/or critical application shutting down, rebooting, or becoming unusable, and an existing administrative or local account is used for this attack. Attack from a user who can access a local user account from which higher-level privileges are available. For example, see the advisory at http://support.avaya.com/elmodocs2/security/ASA-2006-262.htm
Low	The product does not meet criteria for medium or high vulnerability, but is vulnerable to: Compromise of the confidentiality, integrity, or availability of resources, although any compromise is difficult or unlikely without non-standard direct user interaction. Non-critical applications shutting down, rebooting, or becoming unusable. For example, see the advisory at http://support.avaya.com/elmodocs2/security/ASA-2007-015.htm.
None	A related third-party product has a vulnerability but the affected software package(s), module(s), or configuration(s) are not used on an Avaya product and there is therefore no vulnerability. For example, see the advisory at http://support.avaya.com/elmodocs2/security/ASA-2006-261.htm.