Alcatel-Lucent OmniTouch Contact Center Security Bypass and Information Disclosure Vulnerabilities

Bugtraq ID:	43340
Class:	Design Error
CVE:	CVE-2010-3279 CVE-2010-3280
Remote:	Yes
Local:	No
Published:	Sep 20 2010 12:00AM
Updated:	Sep 20 2010 12:00AM
Credit:	Axel Rengstorf of Bluebox Security and Florian Walther of n.runs AG.
Vulnerable:
Not Vulnerable:

Alcatel-Lucent OmniTouch Contact Center Security Bypass and Information Disclosure Vulnerabilities

Alcatel-Lucent OmniTouch Contact Center is prone to a security-bypass vulnerability and an information-disclosure vulnerability.

Attackers can exploit theses issues to obtain sensitive information or perform unauthorized actions.

Versions prior to OmniTouch Contact Center Standard Edition 9.0.8.4 are vulnerable.

Alcatel-Lucent OmniTouch Contact Center Security Bypass and Information Disclosure Vulnerabilities

Attackers can use readily available tools to exploit these issues.

Alcatel-Lucent OmniTouch Contact Center Security Bypass and Information Disclosure Vulnerabilities

Solution:
Reports indicate that these issues have been fixed by the vendor but Symantec has not confirmed it. Please contact the vendor for more information.

Alcatel-Lucent OmniTouch Contact Center Security Bypass and Information Disclosure Vulnerabilities

References:

• OmniTouch Contact Center - Standard Edition (Alcatel-Lucent )
  
• n.runs-SA-2010.001 - Alcatel-Lucent - unauthenticated administrative access to C ()