CVE-2004-0839: Avaya Definity One Media Server

Medium severity, CVSS 5.0. EPSS: 34% chance of exploitation in the next 30 days.

Internet Explorer in Windows XP SP2, and other versions including 5.01 and 5.5, allows remote attackers to install arbitrary programs via a web page that uses certain styles and the AnchorClick behavior, popup windows, and drag-and-drop capabilities to drop the program in the local startup folder, as demonstrated by "wottapoop.html".

Affected products

• Avaya Definity One Media Server: any version
• Avaya IP600 Media Servers: any version
• Avaya Modular Messaging Message Storage Server: version 1.1 only; version 2.0 only
• Avaya s3400: any version
• Avaya s8100: any version
• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 5.0.1 only; version 5.5 only; version 6.0 only
• Microsoft Windows 2000: any version
• Microsoft Windows 2003 Server: version enterprise only; version enterprise_64-bit only; version r2 only; version standard only; version web only
• Microsoft Windows 98: any version
• Microsoft Windows 98se: any version
• Microsoft Windows Me: any version
• Microsoft Windows XP: any version
• Nortel IP Softphone 2050: any version
• Nortel Mobile Voice Client 2050: any version
• Nortel Optivity Telephony Manager: any version
• Nortel Symposium Web Centre Portal: any version
• Nortel Symposium Web Client: any version

Published 2004-08-18. Last modified 2026-06-16.