what you don't know can hurt you

Nortel Contact Center Manager Authentication Bypass

Nortel Contact Center Manager Authentication Bypass
Posted May 27, 2009
Authored by Bernhard Mueller | Site sec-consult.com

SEC Consult Security Advisory 20090525-0 - The Nortel Contact Center Manager server version 6.0 suffers from an authentication bypass vulnerability.

tags | advisory, bypass
MD5 | 10787677a4020346866b695d84f0393f

Nortel Contact Center Manager Authentication Bypass

Change Mirror Download
SEC Consult Security Advisory < 20090525-0 >
==========================================================================
title: Nortel Contact Center Manager Server Authentication
Bypass
program: Nortel Contact Center Manager Server
vulnerable version: 6.0
homepage: http://www.nortel.com/ccms
found: 2008-11-14
by: Bernhard Mueller / SEC Consult Vulnerability Lab
permanent link: https://www.sec-consult.com/advisories_e.html#a58
==========================================================================

Vendor description:
-------------------

Contact Center Manager Server (CCMS) offers a scalable solution for
dynamic contact center environments requiring sophistication and
differentiation in the care offered to their customers. CCMS provides
skill-based routing; call treatment flexibility, real time displays,
multimedia routing, and comprehensive management and reporting
functionality - empowering contact center managers with the tools and
agility to deliver unique and unprecedented care to their customers. The
rich scripting language supports multifaceted call routing and treatment
decisions based on combinations of real time conditions.

[source: http://www.nortel.com/ccms]


Vulnerability overview:
-----------------------

The Nortel Contact Center Manager Server web application relies on
client side cookies to check the roles of authenticated users.
Authentication can be bypassed by manually setting the required cookies.
By exploiting this vulnerability, an attacker can bypass authentication
and access the Nortel Contact Center Manager Server.


Vulnerability description:
--------------------------

The following cookies have to be set to access all menu items:

LoginMsgSwitch=True
LoginMsgAccepted=True
Logged=True
isAdmin=True
LoginMsgSwitch=True
LoginMsgAccepted=True
IsConfig=1
IsUser=1
IsRTD=1
IsReport=1
IsScript=1
IsAudit=1
IsEmHelp=1
isOutbound=1
UserID=x
AuditSwitch=on
LoginMsgAccepted=True


Proof of concept:
-----------------

This vulnerability can be exploited with a web browser and plugins / web
proxy.


Vulnerable versions:
--------------------

The version tested was 06.00.004.03 with the following updates applied:

CCMA_6.0_SU_05
CCMA_6.0_SUS_0501
CCMA_6.0_SUS_0502

Prior versions are most likely also vulnerable.


Vendor contact timeline:
------------------------

January 2009: Vendor informed about vulnerability
2009-05-14: Patch available
2009-05-25: Public Release


Patch:
------

The vendor has released a vulnerability fix which addresses the issue.
In addition, the vendor has released a public security advisory
containing update instructions. URL:

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=905698


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

EOF Bernhard Mueller / @2008
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close