Alcatel-Lucent OmniPCX Enterprise is prone to a remote command- execution vulnerability because it fails to adequately sanitize user- supplied data. Attackers can exploit this issue to execute arbitrary commands with the privileges of the 'httpd' user. Successful attacks may facilitate a compromise of the application and underlying webserver other attacks are also possible. Alcatel-Lucent OmniPCX Enterprise R7.1 and prior versions are vulnerable to this issue.

The vendor has released an advisory along with fixes to address this issue. Please see the referenced advisory for information on obtaining fixes.

• http://www.securityfocus.com/bid/25694
• http://www1.alcatel-lucent.com/enterprise/en/products/ip_telephony/omnipcxenterprise/index.html
• http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm

---

Updated on 2017-03-28