NVD Vulnerability Detail

CVE-2010-3280

Summary	The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an authorized session, which allows remote attackers to monitor or reconfigure Contact Center operations via a modified client application.
Publication Date	Sept. 24, 2010, 4 a.m.
Registration Date	Jan. 29, 2021, 11:05 a.m.
Last Update	Nov. 21, 2024, 10:18 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:alcatel-lucent:ccagent::::::::		8.0
cpe:2.3:a:alcatel-lucent:ccagent:7.1:::::::*
cpe:2.3:a:alcatel-lucent:omnitouch_contact_center:-:-:std:::::*

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/41547	Vendor Advisory
2	http://secunia.com/advisories/41547	Vendor Advisory
3	http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010001.pdf	Vendor Advisory
4	http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010001.pdf	Vendor Advisory
5	http://www.nruns.com/_downloads/nruns-SA-2010-001.pdf
6	http://www.nruns.com/_downloads/nruns-SA-2010-001.pdf
7	http://www.securityfocus.com/archive/1/513869
8	http://www.securityfocus.com/archive/1/513869
9	http://www.securityfocus.com/bid/43340
10	http://www.securityfocus.com/bid/43340
11	http://www.vupen.com/english/advisories/2010/2459	Vendor Advisory
12	http://www.vupen.com/english/advisories/2010/2459	Vendor Advisory
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/61920
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/61920

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Alcatel-Lucent OmniTouch Contact Center の TSA コンポーネントの CCAgent オプションにおける Contact Center 操作を監視または再設定される脆弱性

Title	Alcatel-Lucent OmniTouch Contact Center の TSA コンポーネントの CCAgent オプションにおける Contact Center 操作を監視または再設定される脆弱性
Summary	Alcatel-Lucent OmniTouch Contact Center の管理サーバコンポーネントの CCAgent オプションは、クライアント側へ認証チェックを任せおよび認証セッション段階で無条件にクライアントへSuperUserのパスワードを送信するため、Contact Center 操作を監視または再設定される脆弱性が存在します。
Possible impacts	第三者により、変更されたクライアントのアプリケーションを介して、Contact Center 操作を監視または再設定される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 20, 2010, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

Alcatel-Lucent

ccagent 9.0.8.4 およびそれ以前

omnitouch contact center Standard Edition

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-3280	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3280
National Vulnerability Database (NVD)
2	CVE-2010-3280	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3280

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Alcatel-Lucent
1	Unauthenticated administrative access to CTI CCA Server	http://www.alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_CABINET=Corporate&LMSG_CONTENT_FILE=Support/Security/2010001.pdf

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.