Nortel Networks Contact Center Administration CCMA Cookie Authentication Bypass Vulnerability

Bugtraq ID:	34966
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2009 12:00AM
Updated:	May 26 2009 04:30PM
Credit:	Bernhard Muller and David Matscheko of SEC Consult
Vulnerable:	Nortel Networks Contact Center Administration CCMA 6.0
Not Vulnerable:

Nortel Networks Contact Center Administration CCMA Cookie Authentication Bypass Vulnerability

Nortel Networks Contact Center Manager Administration (CCMA) is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which may aid in further attacks.

CCMA 6.0 is vulnerable; other versions may also be affected.

Nortel Networks Contact Center Administration CCMA Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

Nortel Networks Contact Center Administration CCMA Cookie Authentication Bypass Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Nortel Networks Contact Center Administration CCMA Cookie Authentication Bypass Vulnerability

References:

• Contact Center Authentication Bypass (Nortel Networks)
  
• Nortel Contact Center Manager Server Authentication Bypass (Bernhard Mueller / SEC Consult / www.sec-consult.com)
  
• Nortel Networks Homepage (Nortel Networks)
  
• SEC Consult SA-20090525-0 :: Nortel Contact Center Manager Server Authentication (Bernhard Mueller )