Vulnerability identifier: #VU37987

Vulnerability risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-12969

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
IP Office Contact Center
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Avaya

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to cause a denial of service (heap corruption and crash) or execute arbitrary code via a long string to the open method.

Mitigation
Install update from vendor's website.

Vulnerable software versions

IP Office Contact Center: 9.1 - 10.1

---

External links
http://downloads.avaya.com/css/P8/documents/101044091
http://hyp3rlinx.altervista.org/advisories/AVAYA-OFFICE-IP-(IPO)-v9.1.0-10.1-VIEWERCTRL-ACTIVE-X-BUFFER-OVERFLOW-0DAY.txt
http://packetstormsecurity.com/files/144882/Avaya-IP-Office-IPO-10.1-Active-X-Buffer-Overflow.html
http://seclists.org/fulldisclosure/2017/Nov/17
http://www.securityfocus.com/bid/101667
http://www.exploit-db.com/exploits/43120/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.