lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <fb0927a80601161412g468546bcj7c736ff680587e58@mail.gmail.com>
Date: Mon Jan 16 23:15:09 2006
From: shawnmer at gmail.com (Shawn Merdinger)
Subject: Clipcomm CP-100E VoIP wireless desktop phone open
	debug service TCP/60023

I disclosed the following issue at ShmooCon 2006
<http://www.shmoocon.org/> during my "VoIP Wireless Phone Security
Analysis" presentation.

Thanks,
--scm

===============================================================

VENDOR:
Clipcomm

VENDOR NOTIFIED:
7 December, 2005

PRODUCT:
Clipcomm CP-100E VoIP 802.11b Wireless Phone
http://www.clipcomm.co.kr/down/brochure/CP-100.100D.100P.100E.101.101B.pdf
Firmware Version: 1.1.60

VULNERABILITY TITLE:
Clipcomm CP-100E VoIP Wireless Phone open debug service TCP/60023

DETAILS, IMPACT AND WORKAROUND:
An undocumented port and debug service on TCP/60023 enables an
attacker to access without authentication the phone's
configuration/debug shell via telnet. The shell access provides the
attacker with two levels of access. The first level is the CLIP
account that allows general configuration. The second level is the USH
shell, accessed from within the CLIP shell, that allows an attacker to
enable call tracing and debugging, conduct a factory reset, write to
registers, dump memory, etc.

There appears to be no means to neither disable this access nor enable
authentication.

CONTACT INFORMATION:
Shawn Merdinger
shawnmer@...il.com

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ