Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs)

It appears that most diagnostic CGI perl scripts that take
user-supplied input are vulnerable to Remote Command Execution. These
scripts are located on '/html/cswebadm/basic/cgi-bin/'. All the RCE
vulnerabilities discovered were tested with an authenticated session
using the 'craft' account. These vulnerabilities might also be
exploitable by less-privileged accounts, but this has NOT been tested.

The web interface of Avaya Intuity AUDIX LX is also vulnerable to XSS
and CSRF which can be used in conjunction with the RCE vulnerabilities
in different exploitation scenarios.

Successfully tested on: Avaya IntuityTM AUDIX LX R1.1. Other versions
might also be affected. Avaya has stated that IALX 1.1, which was
discontinued in 2007, is the latest vulnerable version. IALX 2.0 SP2
is not vulnerable according to Avaya.

Complete technical details can be found in the following document:

http://www.gnucitizen.org/static/blog/2009/09/Avaya_Intuity_Remote_Command_Execution.pdf

–
pagvac | GNUCITIZEN.org