Information disclosure in Avaya Aura Communication Manager
CVE-2010-2943
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
Vulnerability class: Information Disclosure
EPSS: 0.170 (96.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Avaya Aura_communication_manager — versions 5.2
- Avaya Aura_presence_services — versions 6.1.1, 6.0, 6.1
- Avaya Aura_session_manager — versions 1.1, 6.0, 5.2
- Avaya Aura_system_manager — versions 6.1.1, 6.0, 5.2
- Avaya Aura_system_platform — versions 1.1, 6.0
- Avaya Aura_voice_portal — versions 5.0, 5.1
- Avaya Iq — versions 5.0, 5.1
- Linux Linux_kernel
- Vmware Esx — versions 4.0, 4.1
- Canonical Ubuntu_linux — versions 10.10, 6.06, 10.04
Weakness classification (CWE)
References
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Broken Link)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (Exploit, VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Broken Link)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST, Broken Link)
Frequently asked questions
- What is CVE-2010-2943?
- CVE-2010-2943 is a high-severity vulnerability in Avaya Aura Communication Manager, classified under Information Disclosure. CVSS score: 8.1/10. Published 2010-09-30.
- How severe is CVE-2010-2943?
- High severity. CVSS v3 base score is 8.1 out of 10.