CVE-2017-11309

Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long response

published November 9, 2017

CVSS
—
EPSS
9%
Percentile
95.4
In the wild
Unconfirmed
What it is

⚠️ A buffer overflow in Avaya IP Office could let a remote server take control, just by sending a long response. Imagine that! Think of it like ordering a pizza with so many toppings that the delivery driver can’t fit it through the door — if they try to squeeze it in anyway, the whole order could get messed up! This vulnerability allows a remote server to execute arbitrary code, which could lead to unauthorized access or control over the system. This is particularly concerning because it could compromise the integrity of communications managed by Avaya IP Office.

Put simply

Think of it like ordering a pizza with so many toppings that the delivery driver can’t fit it through the door — if they try to squeeze it in anyway, the whole order could get messed up! The SoftConsole client in Avaya IP Office before version 10.1.1 suffers from a buffer overflow, where an excessive response from a remote server can overflow the buffer and execute malicious code.

What to do

This vulnerability allows a remote server to execute arbitrary code, which could lead to unauthorized access or control over the system. This is particularly concerning because it could compromise the integrity of communications managed by Avaya IP Office. Update your Avaya IP Office system to version 10.1.1 or later to fix this buffer overflow vulnerability. It's essential to regularly review and apply patches as they become available. You've got this! By taking these proactive steps, you can secure your system and keep those pizza deliveries (or data transmissions) safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.09404 · 95.4th percentile
Published
2017-11-09T19:00Z
EPSS history
Timeline
  • 09 NOV 19:00Z
    Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long response
    cvelistv5