User's Manual

MS09-020 Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation
of Privilege (970483)
Original Release Date: June 10, 2009
Last Revised: June 10, 2009
Number: ASA-2009-215
Risk Level: Medium
Advisory Version: 1.0
Advisory Status: Final
1. Overview:
Microsoft issued a security bulletin which contained security advisory MS09-020. This
security update resolves vulnerabilities in Microsoft Internet Information Services (IIS)
that could allow elevation of privilege if an attacker sent a specially crafted HTTP request
to a Web site that requires authentication. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the names CVE-2009-1122 and CVE-2009-1535 to
these issues. A description of the vulnerabilities may be found at:
• http://www.microsoft.com/technet/security/bulletin/ms09-020.mspx
Certain Avaya products utilize Microsoft Operating Systems and may be affected by this
vulnerability.
2. Avaya System Products:
Avaya system products include an Operating System with the product when it is
delivered. The system products described below are delivered with a Microsoft Operating
System. Actions to be taken with these products are also described below.
Product:
Affected
Version(s):
Risk
Level:
Actions:
Avaya Messaging
Application Server
All Medium
Avaya recommends that customers
install the security update as provided
via Microsoft Windows Update.
Recommended Actions:
Avaya strongly recommends that customers follow networking and security best practices
by implementing firewalls, ACLs, physical security or other appropriate access
restrictions. Though Avaya believes such restrictions should always be in place; risk to
Avaya's product and the surrounding network from this potential vulnerability may be
mitigated by ensuring these practices are implemented until such time as a product update