SEC Consult Security Advisory < 20090525-0 > ========================================================================== title: Nortel Contact Center Manager Server Authentication Bypass program: Nortel Contact Center Manager Server vulnerable version: 6.0 homepage: http://www.nortel.com/ccms found: 2008-11-14 by: Bernhard Mueller / SEC Consult Vulnerability Lab permanent link: https://www.sec-consult.com/advisories_e.html#a58 ========================================================================== Vendor description: ------------------- Contact Center Manager Server (CCMS) offers a scalable solution for dynamic contact center environments requiring sophistication and differentiation in the care offered to their customers. CCMS provides skill-based routing; call treatment flexibility, real time displays, multimedia routing, and comprehensive management and reporting functionality - empowering contact center managers with the tools and agility to deliver unique and unprecedented care to their customers. The rich scripting language supports multifaceted call routing and treatment decisions based on combinations of real time conditions. [source: http://www.nortel.com/ccms] Vulnerability overview: ----------------------- The Nortel Contact Center Manager Server web application relies on client side cookies to check the roles of authenticated users. Authentication can be bypassed by manually setting the required cookies. By exploiting this vulnerability, an attacker can bypass authentication and access the Nortel Contact Center Manager Server. Vulnerability description: -------------------------- The following cookies have to be set to access all menu items: LoginMsgSwitch=True LoginMsgAccepted=True Logged=True isAdmin=True LoginMsgSwitch=True LoginMsgAccepted=True IsConfig=1 IsUser=1 IsRTD=1 IsReport=1 IsScript=1 IsAudit=1 IsEmHelp=1 isOutbound=1 UserID=x AuditSwitch=on LoginMsgAccepted=True Proof of concept: ----------------- This vulnerability can be exploited with a web browser and plugins / web proxy. Vulnerable versions: -------------------- The version tested was 06.00.004.03 with the following updates applied: CCMA_6.0_SU_05 CCMA_6.0_SUS_0501 CCMA_6.0_SUS_0502 Prior versions are most likely also vulnerable. Vendor contact timeline: ------------------------ January 2009: Vendor informed about vulnerability 2009-05-14: Patch available 2009-05-25: Public Release Patch: ------ The vendor has released a vulnerability fix which addresses the issue. In addition, the vendor has released a public security advisory containing update instructions. URL: http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=905698