lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 26 May 2009 16:45:06 +0200
From: Bernhard Mueller <>
To: Full Disclosure <>,
	Bugtraq <>
Subject: SEC Consult SA-20090525-1 :: Nortel Contact Center Manager Server
 Password Disclosure Vulnerability

SEC Consult Security Advisory < 20090525-1 >
              title: Nortel Contact Center Manager Server Password 
            program: Nortel Contact Center Manager Server
 vulnerable version: 6.0
              found: 2008-11-14
                 by: David Matscheko / SEC Consult Vulnerability Lab
     permanent link:

Vendor description:

Contact Center Manager Server (CCMS) offers a scalable solution for
dynamic contact center environments requiring sophistication and
differentiation in the care offered to their customers. CCMS provides
skill-based routing; call treatment flexibility, real time displays,
multimedia routing, and comprehensive management and reporting
functionality - empowering contact center managers with the tools and
agility to deliver unique and unprecedented care to their customers. The
rich scripting language supports multifaceted call routing and treatment
decisions based on combinations of real time conditions. 


Vulnerability overview:

The Nortel Contact Center Manager Server web application provides a SOAP
interface. This interface does not need authorisation and responds to
certain requests with sensitive information.

Vulnerability description:

The following SOAP request queries the user data for the user

POST /Common/WebServices/SOAPWrapperCommon/SOAPWrapperCommonWS.asmx
Content-Type: text/xml; charset=utf-8
Content-Length: 661

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi=""

The following is an excerpt of the response to the previous query. It
contains the user sysadmin with the corresponding password (password,
server IP address, and server name has been changed):

	&lt;z:row ID='0' ServerName='abcd01' ServerIP=''
		 ServerDescription='abcd01' ServerUserID='sysadmin'
		 ServerType='1' SystemVersion='6.0' OpenQueue='0' HeteroNetworking='0'
		 Network='0' ServerSWBuild='4.4F' ServerSULevel='CCMS_6.0_SU_05'
		 ServerDPLevel='CCMS_6.0_SUS_0503' BasicIVR='1' GracePeriodState='3'

Proof of concept:

This vulnerability can be exploited with a web browser and plugins / web

Vulnerable versions:

The version tested was with the following updates applied:


Prior versions are most likely also vulnerable.

Vendor contact timeline:

January 2009: Vendor informed about vulnerability
2009-05-14: Patch available
2009-05-25: Public Release


The vendor has released a vulnerability fix which addresses the issue.
In addition, the vendor has released a public security advisory
containing update instructions. URL:

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF David Matscheko / @2009

Powered by blists - more mailing lists