n.runs AG http://www.nruns.com/ security(at)nruns.com n.runs-SA-2013.003 15-Mar-2013 ___________________________________________________________________________ Vendor: Polycom, http://www.polycom.com Affected Products: Polycom HDX Series Affected Version: < 3.1.1.2 Vulnerability: Polycom H.323 CDR Database SQL Injection Risk: HIGH ___________________________________________________________________________ Overview: For every received H.323 SETUP packet the Polycom HDX system writes a call detail record (CDR) into its internal database. This even happens when the connection is not accepted. The CDR table is stored in a SQLite database which can be found in the /data/polycom/cdr/new/localcdr.db file on the HDX system. Description: One of the items stored in a CDR entry is the remote system name of the H.323 video call. The system name is taken directly from the string placed in the Display information element from the sent H.323 SETUP packet. However no input validation is performed on the string extracted from the packet. The SQL query string to insert a new CDR is constructed by simple string concatenation. Since the Display information element can contain strings with embedded single quote characters the code is vulnerable to a simple SQL injection vulnerability. The vulnerability can easily be demonstrated by sending a H.323 SETUP packet with a Display information element which contains a single quote character. The following log entries can be observed when sending the remote system name "SQL'INJECT": DEBUG avc: pc[0]: INSERT into CDR_Table values('82','1347442631','1347443321', '690','---','SQL'INJECT','','---','h323','0','','1','327','1','0','---','--- ', 'term DEBUG avc: pc[0]: Can't prepare database: near "INJECT": syntax error DEBUG avc: pc[0]: sqlInsert: time = 1 DEBUG avc: pc[0]: NOTIFY: SYS config cdrrowid1 0 "83" rw DEBUG avc: pc[0]: H323Conn[0]: state:"incoming" --> "disconnecting" DEBUG avc: pc[0]: H323Call[0]: hangup, cause code 16 Impact: An unauthenticated attacker could try to exploit this vulnerability over the network in order to manipulate the constructed SQL query. In the worst case such a bug could lead to remote code execution through the injection of specific SQL statements. Only a single TCP packet would be needed for such an attack. Solution: Polycom released version 3.1.1.2 of the HDX software which fixes this issue. It can be downloaded from the Polycom Support page at http://support.polycom.com. ___________________________________________________________________________ Credit: Bug found by Moritz Jodeit of n.runs AG. ___________________________________________________________________________ Unaltered electronic reproduction of this advisory is permitted. For all other reproduction or publication, in printing or otherwise, contact security@nruns.com for permission. Use of the advisory constitutes acceptance for use in an "as is" condition. All warranties are excluded. In no event shall n.runs be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if n.runs has been advised of the possibility of such damages. Copyright 2013 n.runs AG. All rights reserved. Terms of use apply.