Generally, Avaya makes security updates available on or through the Avaya Security Web site at http://support.avaya.com/security. In addition, Avaya incorporates security updates, if applicable, in subsequent software release packages.
Based on the classification of vulnerability and the availability of a vendor-supplied update, Avaya makes a best effort attempt to provide remediation actions based on the following target intervals:
| Vulnerability | Target remediation intervals |
|---|---|
| High | If Avaya needs to develop a software update, the Avaya Security Advisory provides a timeline for availability of the update. Avaya incorporates the fix into a separate service pack or update (30 days maximum delivery time).
If a software patch is available for installation or another action is recommended, the Avaya Security Advisory describes the actions. |
| Medium | If Avaya needs to develop a software update, Avaya includes the update in the next major release that can reasonably incorporate the update. If no new major releases are scheduled for a product, and Avaya is providing maintenance support, Avaya incorporates the fix into a separate service pack or update (1 year maximum delivery time).
If a software patch is available for installation or another action is recommended, the Avaya Security Advisory describes the actions. |
| Low | If Avaya needs to develop a software update, Avaya includes the update in the next major release that can reasonably incorporate the update. If no new major releases are scheduled for a product, and Avaya is providing maintenance support, Avaya incorporates the fix into a separate service pack or update (1 year maximum delivery time).
If a software patch is available for installation or another action is recommended, the Avaya Security Advisory describes the actions. |
| None | No remediation actions are required. |
Avaya simply bundles the specific update or the new release of the affected software with the Messaging software such that the security-related updates are automatically incorporated into the Avaya product operation.
Avaya modifies the Messaging software so that the specific update or the new release of the affected software is appropriately incorporated into the Messaging operation.
Avaya modifies the specific update or the new release of the affected software so that the security-related updates are automatically incorporated into the Messaging operation.
A security update
A security update includes operating system and/or third-party software security fixes.
An Avaya software update
An Avaya software update includes software security fixes to the Avaya application software.
An Avaya full release of software
An Avaya full release of software includes all software for the Avaya product, including software security fixes to the Avaya application software and/or security fixes for the operating system and third-party fixes.