Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Phreaking General Information :: va3178.htm

Nortel Application Gateway 2000 Password Disclosure Vulnerability



SEC Consult SA-20090415-1 :: Nortel Application Gateway 2000 Password Disclosure Vulnerability
SEC Consult SA-20090415-1 :: Nortel Application Gateway 2000 Password Disclosure Vulnerability



SEC Consult Security Advisory < 20090415-1 >
=========================================================================              title: Nortel Application Gateway 2000 Password 
                     Disclosure Vulnerability
            program: Nortel Application Gateway 2000
 vulnerable version: 6.3.1 and prior
homepage: http://www.nortel.com/ag2000 
              found: 2008-11-14
by: David Matscheko / SEC Consult / www.sec-consult.com 
               link:
https://www.sec-consult.com/files/20090415-1_nortel_AG_password_disclosure.txt 
=========================================================================
Vendor description:
-------------------

The Application Gateway delivers practical, converged voice and data
applications on Nortel IP phones that enable organizations to benefit
more fully from IP telephony. The prepackaged, easy-to-learn,
easy-to-use Voice Office applications help increase productivity and
enhance organizational communications - without requiring any
integration work. For the hospitality sector, the Guest Services
applications provide additional services/features, generate revenue from
advertising on the phone screen, and reduce the cost of operations by
enabling guests to self serve. Custom development tools are also
available to end customers for delivery of customized content to IP
phones.

[source: http://www.nortel.com/ag2000] 


Vulnerability overview:
-----------------------

The Nortel Application Gateway provides an administration interface
"Nortel Administration Tool powered by Citrix". This interface responds
with sensitive information to unauthorized users.


Vulnerability description:
--------------------------

The "Nortel Administration Tool powered by Citrix" can be accessed under
the URL "https://:3001/". The subframe
"https://:3001/adminDownloads.htm" does not show any content in
the browser view. However the HTML-source of this frame contains
sensitive information like an administrative call server user account:

---
[...]
[...]
--- Proof of concept: ----------------- This vulnerability can be exploited with a web browser and plugins / web proxy. Vendor contact timeline: ------------------------ January 2009: Vendor informed about vulnerability 2009-04-14: Patch available Patch: ------ The vendor has released a vulnerability fix which addresses the issue. In addition, the vendor has released a public security advisory containing update instructions. URL: http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=865005 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Unternehmensberatung GmbH Office Vienna Mooslackengasse 17 A-1190 Vienna Austria Tel.: +43 / 1 / 890 30 43 - 0 Fax.: +43 / 1 / 890 30 43 - 25 Mail: research at sec-consult dot com www.sec-consult.com EOF SEC Consult Vulnerability Lab / @2009


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH