________________________________________________________________________

Recurity Labs GmbH
http://www.recurity-labs.com
entomology@recurity-labs.com
Date: 08.11.2011
________________________________________________________________________

Vendor:             Cisco Systems
Product:            CUCM Environment
                      Cisco Unified Communications Manager (CallManager)
                      Cisco IP Phone CP-7975G
Vulnerability:      Directory Traversal
                    Reversible Obfuscation Algorithm
                    SCCP service security issues
                    CTFTP Information Leaks
                    Voice VLAN Separation Activated Late
Affected Releases:  7.0, 8.0(2)
Severity:           HIGH

________________________________________________________________________

Vendor communication:
  25.05.2010        Initial notification to PSIRT
  25.05.2010        PSIRT acknowledges the report
  25.05.2010        Various acknowledgements from Cisco, some issues are
                    apparently already know.
  28.05.2010        PSIRT still works on evaluations.
  17.06.2010        PSIRT updates on the issues reported
  03.02.2011        Requesting update from PSIRT
  04.02.2011        Response that the case handler has left PSIRT
  28.03.2011        A personal meeting during BlackHat Europe had
                    effects, new case handler reports the directory
                    traversal issue being fixed.
  11.10.2011        Checking back with PSIRT and providing draft
                    advisory
  11.10.2011        Latest status updates on two issues and
                    agreement on 2011-10-26 coordinated release
  26.10.2011        Cisco releases cisco-sa-20111026-cucm
  08.11.2011        Release
________________________________________________________________________

Overview:
  Product is Unified Communications solutions from Cisco Systems. From
  the Web Site:

  "Cisco Unified Communications Manager is an enterprise-class IP
  communications processing system for up to 40,000 users, extensible to
  80,000 users by way of a megacluster."

  There is a remotely exploitable directory traversal vulnerability in
  CUCM that allows attackers to read internal files available to the
  Tomcat user. By design, this user has access to various sensitive
  files. Therefore this vulnerability can be abused to lead to a full
  system compromise of the CUCM system.

  The vulnerability can be triggered before authentication.

  Other vulnerabilities and issues are documented within this advisory
  as well.


Description:

  Directory Traversal:

  The directory traversal vulnerability can be triggered from the
  following location:

  http://[cucm]:8080/ccmivr/IVRGetAudioFile.do?file=[filename]


  Reversible Obfuscation Algorithm:

  The file platformConfig.xml is used to store various configuration
  parameters which are used by the CUCM system. This includes network
  configuration as well as "encrypted" passwords. The passwords are
  encrypted using keys that are hardcoded within the system.


  SCCP service security issues

  When one sends a RegisterMessage SCCP message with a malformed
  "DeviceName" containing a single quote, it appears that one can inject
  SQL commands. Additionally, while handling the malformed "DeviceName",
  when certain characters are processed by the ODBC driver, the driver
  crashes on a memcpy().


  CTFTP Information Leaks:

  The CTFTP service is a custom HTTP server that listens on port 6970.
  The following hardcoded paths can be used to disclose information
  about the CUCM configuration:

    - TFTP file list /ConfigFileCacheList.txt including phone
      configuration filename (which may contain passwords)
    - Other interesting locations /BinFileCacheList.txt, /FileList.txt,
      /PerfMon.txt, /ParamList.txt, /lddefault.cfg


  Voice VLAN Separation Activated Late:

  The Cisco phones have a port for connecting the PC that should not
  pass voice VLAN tagged packets. When the phone is properly configured
  it will only pass the correct packets to the PC port. It was however
  observed that during boot, an attacker has a time window of roughly
  10 seconds where they can make receive and send voice VLAN tagged
  packets. This means that during that time, an attacker can gain access
  to the Voice VLAN without making any physical network changes (i.e. No
  need to disconnect the phone).

  Note that this has been tested on CP-7975G with an SCCP firmware


Examples:
   Typical example is to read /etc/passwd:

http://[cucm]:8080/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd

   In this case we can read more useful files such as platformConfig.xml
   which contains obfuscated administrative passwords:

http://[cucm]:8080/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml

   Attackers can then login to the administrative Web interface by using
   the decoded credentials from this file.

   To decode the credentials of "ApplUserDbPwCrypt" from
   platformConfig.xml:
   1. Search for "ParamValue" xml tag where the "ParamDefaultValue" is
      "password".
   2. The value of "ParamValue" can then be decrypted by making use of
      AES128-CBC as follows:
            a) The first 16 bytes are used as IV
            b) The second 16 bytes are the encrypted password
            c) Initialize the cipher using the IV and key
               "smetsysocsicni"
            d) Decrypt the encrypted password

   Steps to reproduce the VLAN separation issue:
   1. Start sniffing using Wireshark on the computer connected to the PC
      port
   2. Apply the Wireshark display filter "VLAN" ; this will allow us to
      only see VLAN tagged packets
   3. Soft restart the Cisco phone by pressing on the settings button
      and then **#**
   4. Wireshark should start displaying broadcast packets from the voice
      VLAN for a 10 second period

Solution:
  Cisco Bug ID CSCth09343, see
  See http://www.cisco.com/warp/public/707/cisco-sa-20111026-cucm.shtml

  Cisco Bug ID CSCsy45946, status unknown.

  Cisco Bug ID CSCth06428, fixed.

  According to Cisco, the TFTP hardcoded file names are by design.

  According to Cisco, the hard phones work as designed.

________________________________________________________________________

Credit:
  Found by Sandro Gauci (EnableSecurity) and Felix Lindner (Recurity
  Labs)

  Greets to Gaus and Cisco PSIRT.
________________________________________________________________________

The information provided is released "as is" without warranty
of any kind. The publisher disclaims all warranties, either express or
implied, including all warranties of merchantability. No responsibility
is taken for the correctness of this information.
In no event shall the publisher be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business
profits or special damages, even if the publisher has been advised of
the possibility of such damages.

The contents of this advisory are copyright (c) 2011 Recurity Labs GmbH
and may be distributed freely provided that no fee is charged for this
distribution and proper credit is given.
________________________________________________________________________