n.runs AG
http://www.nruns.com/
security(at)nruns.com
n.runs-SA-2013.004
15-Mar-2013
___________________________________________________________________________
Vendor:    Polycom, http://www.polycom.com
Affected Products:  Polycom HDX Series
Affected Version:  < 3.1.1.2
Vulnerability:    Polycom H.323 Format String Vulnerability
Risk:      HIGH
___________________________________________________________________________

Overview:

For every received H.323 SETUP packet the Polycom HDX system writes a call
detail record (CDR) into its internal database. This even happens when the
connection is not accepted. The CDR table is stored in a SQLite database
which can be found in the /data/polycom/cdr/new/localcdr.db file on the
HDX system.

Description:

One of the items stored in a CDR entry is the remote system name of the
H.323 video call. The system name is taken directly from the string
placed in the Display information element from the sent H.323 SETUP
packet. However no input validation is performed on the string extracted
from the packet. After the SQL query string is constructed it is passed
to the internal puts() function which ends up calling the vsnprintf()
function inside va_logmsg() for logging purposes. The complete SQL query
string is passed as the format string argument to vsnprintf() which leads
to a format string vulnerability.

The following output shows the arguments passed to the va_logmsg()
function. Part of the "fmt" format string argument is the embedded
Display information element which is under the control of the attacker.

    (gdb) break *0x1032E3AC
    Breakpoint 1 at 0x1032e3ac: file ../../../src/Common/OS/logmsg.c, line
747.
    (gdb) c
    Breakpoint 5, 0x1032e3ac in va_logmsg (ap=0x5e97d298, level=<optimized
out>,
        component=<optimized out>, fmt=0x5e97d344 "INSERT into CDR_Table
values(
        '23','0','1347451282','1347451282','---','WE CONTROL THIS
%n%n%n','','---',
 
'h323','0','','1','365','1','0','---','---','terminal','','---','---',
        '---','---','---','---','The call has
ended.','16','0','---','---','---',
        '---','---','---','---','---','---','---','---','---','25');")
        at ../../../src/Common/OS/logmsg.c:747

Since the attacker controls the format string through the sent remote
system name, he can easily crash the system by sending a single H.323
SETUP packet with a remote system name such as "%n%n%n".

However this bug also allows remote code execution by sending several
specially formed H.323 SETUP packets. This allows a complete system
compromise of the HDX system over the network.

Impact:

This vulnerability can be exploited by an unauthenticated attacker
over the network as long as the H.323 protocol is enabled. The
auto-answer call feature must not be enabled for the exploit to
succeed. Successful exploitation gives an attacker complete root
access to the HDX system and thus full control over the device.

n.runs successfully developed a proof-of-concept exploit which
demonstrates remote code execution over the network.

Solution:

Polycom released version 3.1.1.2 of the HDX software which fixes this
issue. It can be downloaded from the Polycom Support page at
http://support.polycom.com.
___________________________________________________________________________

Credit:
Bug found by Moritz Jodeit of n.runs AG.
___________________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall n.runs be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if n.runs has been advised of the possibility of
such damages.

Copyright 2013 n.runs AG. All rights reserved. Terms of use apply.