Date: Thu, 29 Apr 2004 16:34:35 -0400
From: "Michael Scheidell" <scheidell@...nap.net>
To: <bugtraq@...urityfocus.com>,
	<vulnwatch@...nwatch.org>
Cc: <incidents@...urityfocus.com>,
	<intrusions@...idents.org>,
	<full-disclosure@...ts.netsys.com>
Subject: 3com NBX VOIP NetSet Denial of Service Attack


Systems: 3com NBX IP VOIP NetSet(r) Configuration Manager
Severity: Serious 
Category: Denial of Service 
Classification: Insufficient user input checking
BugTraq-ID: TBD
CERT VU#: TBD
CVE ID: TBD
Vendor URL: www.3com.com
Author: Michael S. Scheidell, SECNAP Network Security Corporation
Original Release date: April 20, 2004
Notifications: 3com Notified via email April 20, 2004, no response
Last contact with 3com: NA

Discussion: From 3com's web site:

3Com® SuperStack® 3 NBX® and 3Com NBX 100 networked telephony solutions offer wide-ranging price/performance alternatives to fit your business needs today and tomorrow. 3Com® SuperStack® 3 NBX® Networked Telephony Solution Delivers robust, full-featured business communications for up to 1500 devices (lines/stations) Ensures high system availability with the Wind River VxWorks real-time operating system (also used in pacemakers and artificial hearts), so server and PC downtime does not impact your telephone service. 

Exploit: It was possible to make the remote Virata-EmWeb/R6_0_3 server (the NBX Netset application) crash by running a standard nessus scan in safeChecks mode.  Note: Saftchecks mode only does web queries, XSS, etc..

The 3com NBX uses VXWORKS Embedded Real time Operating system and what appears to be Virata-EmWeb/R6_0_3 web server.  this web server is used by the NetSet configuration program to update/reboot/backup/configure and check status on the 3com NBX VPIO call manager.  It is also used by each phone user to change speed dial numbers, configure call forwarding and other features of their individual phone sets.  By running the nessus vulnerabilities scanner, in safeChecks mode, a hacker or user can disable the Netset status, Call detail functions, maintenance functions, including the ability to 'soft boot' system.  Note: you may still be able to connect a 9600 baud terminal to the 3com NBX Call Manager and soft boot system, but this requires physical access and would need to be done each and every time someone ran nessus.  Also note, that with the proliferation of web based attacks on the net lately, and the fact that the nessus tests are just a 'safe' version of these exploits, this creates a serious problem for the NBX.

Also note, that the NBX is NOT SIP, but rather uses 3com proprietary multi-cast protocol, an enterprise that deploys the 3com VOIP NBX system and expects to use the functions on a remote phone must either use a Multicast VPN router (rare and expensive), or place the NBX on the outside of the firewall.  Also, there is no ability to keep hackers and crackers from connecting to the 'open/bare' nbx call manager web port via ip access control lists on the nbx.  A quick google search will find several 3com nbx systems with the Call manager exposed.

http://ipphone.cybertown.co.at/
http://telephone.michiganaerospace.com/
http://nbxss3.shoreschool.org/

This condition is not recovered without a Hard reboot (power off/on). Since the 3com nbx is based on an embedded Unix operating system (vxworks), an abrupt power off could cause loss of data, including corruption of voice mails in progress or logs. 

A company who uses the VoIP features for remote locations, and who has the call manager located on the outside of their firewall, or has no firewall can have their VOIP management functions disrupted easily. Even if the company has call manager located on internal network, people with internal network access can also disrupt communications. 

We have tested 3com nbx firmware version 4_2_7 (with embedded web server Virata-EmWeb/R6_0_3).

3com should have had in place the ability to test their new software versions in QA, especially since they know, or should know that these systems can be exposed to attack from the internet.  3com has known since at least October 2002 when we informed them of the security problems with the built in ftp server.  We have asked 3com several times since then for updated copies of the firmware to address the problem, and for us to test but have not had a response from 3com since December, 2002.

See http://www.secnap.com/security/nbx001.html for details of previous DOS problems with 3com nbx system)

Update/Workaround:  no workaround found.  No way to change the default port to 'hide' this vulnerable server.  Place server on VLAN and restrict access.  Do not use NBX VOIP for remote offices or phones unless you have a MultiCast capable VPN or private VPN.

3com Response: None

Solution: 
Please contact vendor for new firmware when they fix it.

For a report on Security Risk Factors with IP Telephony based Networks 
see: 
Security_Risk_Factors_with_IP_Telephony_based_Networks Also reference article "is VoIP vulnerable ?"on NWfusion.com http://www.nwfusion.com/news/2002/0624voip.html 

see "Firewall limits vex VoIP users" at Nwfusion 
http://www.nwfusion.com/news/2002/0625bleeding.html 

For earlier problems with 3com NBX, ftp denial of service attack, see http://www.secnap.com/security/nbx001.html
Credit: 
This problem was originally found during a routine security audit by Michael Scheidell, SECNAP Network Security, www.secnap.com using the Nessus vulnerabilities scanner, www.nessus.org., 

Additional Information: 

To test your systems for this vulnerability, you can use Nessus at www.nessus.org. 
Select default scan runs.

Original copy of this report can be found here 
<http://www.secnap.net/security/20040420.html> 

Copyright: 
Above Copyright(c) 2004, SECNAP Network Security Corporation. World rights reserved. 

This security report can be copied and redistributed electronically provided it is not edited and is quoted in its entirety without written consent of SECNAP Network Security Corporation. Additional information or permission may be obtained by contacting SECNAP Network Security at 561-368-9561 or www.secnap.com

Powered by blists - more mailing lists