Nortel Contact Center Manager Administration Password Disclosure Vulnerability

Bugtraq ID:	34964
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2009 12:00AM
Updated:	May 27 2009 12:50PM
Credit:	Bernhard Muller and David Matscheko of SEC Consult
Vulnerable:	Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Administration CCMA 6.0 Nortel Networks Contact Center
Not Vulnerable:

Nortel Contact Center Manager Administration Password Disclosure Vulnerability

Nortel Contact Center Manager Administration is prone to a password-disclosure vulnerability caused by a design error.

Attackers can exploit this issue to gain access to the 'sysadmin' password. Successfully exploiting this issue may lead to other attacks.

Nortel Contact Center Manager Administration Password Disclosure Vulnerability

An attacker can use a browser to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/34964.txt

Nortel Contact Center Manager Administration Password Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

Nortel Contact Center Manager Administration Password Disclosure Vulnerability

References:

• Nortel Networks Homepage (Nortel Networks)
  
• SEC Consult SA-20090525-1 :: Nortel Contact Center Manager Server Password Discl (SEC Consult Vulnerability Lab)
  
• SEC Consult SA-20090525-1 :: Nortel Contact Center Manager Server Password Discl (Bernhard Mueller )
  
• Contact Center Potential Password Disclosure (Nortel Networks)