n.runs AG
http://www.nruns.com/
security(at)nruns.com
n.runs-SA-2013.003
15-Mar-2013
___________________________________________________________________________
Vendor:    Polycom, http://www.polycom.com
Affected Products:  Polycom HDX Series
Affected Version:  < 3.1.1.2
Vulnerability:    Polycom H.323 CDR Database SQL Injection
Risk:      HIGH
___________________________________________________________________________

Overview:

For every received H.323 SETUP packet the Polycom HDX system writes a call
detail record (CDR) into its internal database. This even happens when the
connection is not accepted. The CDR table is stored in a SQLite database
which can be found in the /data/polycom/cdr/new/localcdr.db file on the
HDX system.

Description:

One of the items stored in a CDR entry is the remote system name of the
H.323 video call. The system name is taken directly from the string
placed in the Display information element from the sent H.323 SETUP
packet. However no input validation is performed on the string extracted
from the packet. The SQL query string to insert a new CDR is constructed
by simple string concatenation. Since the Display information element can
contain strings with embedded single quote characters the code is
vulnerable to a simple SQL injection vulnerability.

The vulnerability can easily be demonstrated by sending a H.323 SETUP
packet with a Display information element which contains a single
quote character. The following log entries can be observed when sending
the remote system name "SQL'INJECT":

    DEBUG avc: pc[0]: INSERT into CDR_Table
values('82','1347442631','1347443321',
 
'690','---','SQL'INJECT','','---','h323','0','','1','327','1','0','---','---
',
    'term
    DEBUG avc: pc[0]: Can't prepare database: near "INJECT": syntax error
    DEBUG avc: pc[0]: sqlInsert: time = 1
    DEBUG avc: pc[0]: NOTIFY: SYS config cdrrowid1 0 "83" rw
    DEBUG avc: pc[0]: H323Conn[0]: state:"incoming" --> "disconnecting"
    DEBUG avc: pc[0]: H323Call[0]: hangup, cause code 16

Impact:

An unauthenticated attacker could try to exploit this vulnerability
over the network in order to manipulate the constructed SQL query. In
the worst case such a bug could lead to remote code execution through
the injection of specific SQL statements. Only a single TCP packet
would be needed for such an attack.

Solution:

Polycom released version 3.1.1.2 of the HDX software which fixes this
issue. It can be downloaded from the Polycom Support page at
http://support.polycom.com.
___________________________________________________________________________

Credit:
Bug found by Moritz Jodeit of n.runs AG.
___________________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall n.runs be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if n.runs has been advised of the possibility of
such damages.

Copyright 2013 n.runs AG. All rights reserved. Terms of use apply.