Sign-up

ID

VAR-201407-0034


CVE

CVE-2014-3427


TITLE

Yealink VoIP Phone In the firmware CRLF Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-003364

DESCRIPTION

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. Yealink VoIP Phone The firmware of CRLF An injection vulnerability exists. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Yealink VoIP Phones are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. I. BACKGROUND Yealink is a manufacturer of VoIP and Video products. To minimize noise read more at: http://www.yealink.com/Companyprofile.aspx III. Validated on Firmware Version 28.72.0.2 Hardware Version 28.2.0.128.0.0.0 CRLF Injection (Header Splitting) proof of concept: Request GET /servlet?linepage=1&model=%0d%0a%20 ANYTHING I WANT GOES HERE &p=dsskey&q=load HTTP/1.1 In the above request, attackers can shove in code, webpages, etc. In my tests, I have used javascript, redirects, and even an entire web page shoved into the CRLF vulnerable inputs. ----- The XSS vulnerability GET /servlet?jumpto=dsskey&model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22&p=login&q=loginForm HTTP/1.1 Typical Cross Site Scripting. IV. SOLUTION Minimize accessibility to the phone's interface. V. VENDOR CONTACT AND RESPONSE 05/08/2014 E-mailed security@yealink.com (bounced) 05/08/2014 Created an account on Yealink's forum and sent message (no response for weeks) 05/26/2014 Response via e-mail from Yealink 05/26/2014 Replied to vendor I would disclose in June 06/01/2014 Reached back out to vendor for update 06/08/2014 Reached back out to vendor for update 06/11/2014 Rouched out one last time... Crickets 06/12/2014 Advisory VI. TOOLS USED Burpsuite, WVS, Firefox -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

Trust: 2.07

sources: NVD: CVE-2014-3427 // JVNDB: JVNDB-2014-003364 // BID: 68022 // VULHUB: VHN-71367 // PACKETSTORM: 127081

AFFECTED PRODUCTS

vendor:yealinkmodel:voip phonescope:eqversion:28.72.0.2

Trust: 2.4

vendor:yealinkmodel:voip phonescope:eqversion:28.2.0.128.0.0.0

Trust: 0.8

vendor:yealinkmodel:hardwarescope:eqversion:28.2.0.128.0.0.0

Trust: 0.3

vendor:yealinkmodel:yealinkscope:eqversion:28.72.0.2

Trust: 0.3

sources: BID: 68022 // JVNDB: JVNDB-2014-003364 // CNNVD: CNNVD-201406-642 // NVD: CVE-2014-3427

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3427
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-3427
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201406-642
value: MEDIUM

Trust: 0.6

VULHUB: VHN-71367
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-3427
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-71367
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-71367 // JVNDB: JVNDB-2014-003364 // CNNVD: CNNVD-201406-642 // NVD: CVE-2014-3427

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2014-003364 // NVD: CVE-2014-3427

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-642

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201406-642

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003364

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-71367

PATCH
title:Top Pageurl:http://www.yealink.com/index.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-003364

EXTERNAL IDS
db:NVDid:CVE-2014-3427
Trust: 2.9
db:PACKETSTORMid:127081
Trust: 1.2
db:BIDid:68022
Trust: 1.0
db:JVNDBid:JVNDB-2014-003364
Trust: 0.8
db:CNNVDid:CNNVD-201406-642
Trust: 0.7
db:EXPLOIT-DBid:39334
Trust: 0.1
db:VULHUBid:VHN-71367
Trust: 0.1
sources:
            
            
            VULHUB: VHN-71367 // 
            
            
            
            BID: 68022 // 
            
            
            
            JVNDB: JVNDB-2014-003364 // 
            
            
            
            PACKETSTORM: 127081 // 
            
            
            
            CNNVD: CNNVD-201406-642 // 
            
            
            
            NVD: CVE-2014-3427

REFERENCES
url:http://seclists.org/fulldisclosure/2014/jun/74
Trust: 1.7
url:http://www.securityfocus.com/archive/1/archive/1/532410/100/0/threaded
Trust: 1.4
url:http://www.securityfocus.com/archive/1/532410/100/0/threaded
Trust: 1.1
url:http://packetstormsecurity.com/files/127081/yealink-voip-phones-xss-crlf-injection.html
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3427
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3427
Trust: 0.8
url:http://www.securityfocus.com/bid/68022
Trust: 0.6
url:www.yealink.com
Trust: 0.3
url:http://www.yealink.com/companyprofile.aspx
Trust: 0.1
url:http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2bf7d83f210a95af
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3428
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3427
Trust: 0.1
sources:
            
            
            VULHUB: VHN-71367 // 
            
            
            
            BID: 68022 // 
            
            
            
            JVNDB: JVNDB-2014-003364 // 
            
            
            
            PACKETSTORM: 127081 // 
            
            
            
            CNNVD: CNNVD-201406-642 // 
            
            
            
            NVD: CVE-2014-3427

CREDITS
Jesus Oquendo
Trust: 1.0
sources:
            
            
            BID: 68022 // 
            
            
            
            PACKETSTORM: 127081 // 
            
            
            
            CNNVD: CNNVD-201406-642

SOURCES
db:VULHUBid:VHN-71367
db:BIDid:68022
db:JVNDBid:JVNDB-2014-003364
db:PACKETSTORMid:127081
db:CNNVDid:CNNVD-201406-642
db:NVDid:CVE-2014-3427

LAST UPDATE DATE
2024-11-23T22:59:40.303000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-71367date:2018-10-09T00:00:00
db:BIDid:68022date:2014-06-12T00:00:00
db:JVNDBid:JVNDB-2014-003364date:2014-07-17T00:00:00
db:CNNVDid:CNNVD-201406-642date:2014-07-17T00:00:00
db:NVDid:CVE-2014-3427date:2024-11-21T02:08:04.393

SOURCES RELEASE DATE
db:VULHUBid:VHN-71367date:2014-07-16T00:00:00
db:BIDid:68022date:2014-06-12T00:00:00
db:JVNDBid:JVNDB-2014-003364date:2014-07-17T00:00:00
db:PACKETSTORMid:127081date:2014-06-13T00:12:49
db:CNNVDid:CNNVD-201406-642date:2014-06-30T00:00:00
db:NVDid:CVE-2014-3427date:2014-07-16T14:19:02.997