Information disclosure in Avaya Aura Communication Manager
CVE-2010-2943
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.170 (97.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.170 · newest: 0.170 · change: 0.000
Affected products
- Avaya Aura Communication Manager — versions 5.2
- Avaya Aura Presence Services — versions 6.1.1, 6.0, 6.1
- Avaya Aura Session Manager — versions 1.1, 6.0, 5.2
- Avaya Aura System Manager — versions 6.1.1, 6.0, 5.2
- Avaya Aura System Platform — versions 1.1, 6.0
- Avaya Aura Voice Portal — versions 5.0, 5.1
- Avaya Iq — versions 5.0, 5.1
- Linux Kernel
- VMware Esx — versions 4.0, 4.1
- Canonical Ubuntu Linux — versions 10.10, 6.06, 10.04
Weakness classification (CWE)
References
- article.gmane.org/gmane.comp.file-systems.xfs.general/33771 (mailing-list, Broken Link)
- git.kernel.org/
- www.securityfocus.com/bid/42527 (Exploit, VDB Entry, Third Party Advisory, vdb-entry)
- git.kernel.org/
- www.redhat.com/support/errata/RHSA-2010-0723.html (vendor-advisory, Broken Link)
- bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
- www.securityfocus.com/archive/1/520102/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory)
- article.gmane.org/gmane.comp.file-systems.xfs.general/33768 (mailing-list, Broken Link)
- secunia.com/advisories/46397 (Broken Link, third-party-advisory)
- article.gmane.org/gmane.comp.file-systems.xfs.general/33769 (mailing-list, Broken Link)
Frequently asked questions
- What is CVE-2010-2943?
- CVE-2010-2943 is a high-severity vulnerability in Avaya Aura Communication Manager, classified under Information Disclosure. CVSS score: 8.1/10. Published 2010-09-30.
- How severe is CVE-2010-2943?
- High severity. CVSS v3 base score is 8.1 out of 10.