lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <6394b08a-6e3d-48aa-b7af-36d9ee8c5fee@cloudaware.eu> Date: Tue, 20 Feb 2024 13:50:33 +0100 From: "Jeroen J.A.W. Hermans via Fulldisclosure" <fulldisclosure@...lists.org> To: fulldisclosure@...lists.org Subject: [FD] CVE-2024-24681: Insecure AES key in Yealink Configuration Encrypt Tool CloudAware Security Advisory CVE-2024-24681: Insecure AES key in Yealink Configuration Encrypt Tool ======================================================================== Summary ======================================================================== A single, vendorwide, hardcoded AES key in the configuration tool used to encrypt provisioning documents was leaked leading to a compromise of confidentiality of provisioning documents. ======================================================================== Product ======================================================================== * Yealink Configuration Encrypt Tool (AES version) * Yealink Configuration Encrypt Tool (RSA version <v1.2) ======================================================================== Detailed description ======================================================================== The Yealink Configuration Encrypt Tool facilites provisioning and configuration mangement of Yealink products, such as VoIP phones. The tool created AES encrypted provisioning documents, containing configuration directives such as username=user1 passwword=passw0rd! serverhost=sip.host.com callerid=+19051231212 The files created by this tool are then transferred to the Yealink equipment. The equipment decrypts the files and uses them to configure itself. This process needs to be secure. So these files are encrypted. The decryption is done by a static, hardcoded, key that is identical across all installs and customers. After decryption of this file by the hardcoded AES key confidential information, such as user passwords are visible in plain text. This implies that knowledge of this hardcoded key allows for the disclosure of sensitive information from the configuration files, or that files with different information can be introduced and are axiomatically trusted by the phone. As this key is static - this includes historic files from any customer that used this tool. The vendor has fixed this in version 1.2 of the Configuration Encrypt Tool. ======================================================================== Solution ======================================================================== 1) Upgrade Yealink Configuration Encrypt Tool to version 1.2 2) Evaluate the impact of the disclosure of any configurations rolled out with prior versions of this tool (including, specifically, the leaking of passwords) ======================================================================== Mitigation ======================================================================== 1) If an upgrade is not an option - as `anyone' can create valid configuration files; ensure that affected equipment is unable to reach provisioning servers. 2) Evaluate the impact of the disclosure of any configurations rolled out prior to these mitigation steps ======================================================================== Weblinks ======================================================================== https://github.com/gitaware/CVE/tree/main/CVE-2024-24681 ======================================================================== History ======================================================================== early 2020, release of Configuration Encrypt Tool v1 containing RSA encryption method juli 2022, Yealink informed “old” AES key still present and working in tool 2023, new version of Configuration Encrypt Tool v1.2 without a hardcoded AES encryptionkey Download attachment "OpenPGP_0x52DD23305307A27C.asc" of type "application/pgp-keys" (670 bytes) Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes) _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists