[Full-Disclosure] 3com NBX VOIP NetSet Denial of Service Attack

["Michael Scheidell" <scheidell@xxxxxxxxxx>]

Systems: 3com NBX IP VOIP NetSet(r) Configuration Manager
Severity: Serious 
Category: Denial of Service 
Classification: Insufficient user input checking
BugTraq-ID: TBD
CERT VU#: TBD
CVE ID: TBD
Vendor URL: www.3com.com
Author: Michael S. Scheidell, SECNAP Network Security Corporation
Original Release date: April 20, 2004
Notifications: 3com Notified via email April 20, 2004, no response
Last contact with 3com: NA

Discussion: From 3com's web site:

3Com® SuperStack® 3 NBX® and 3Com NBX 100 networked telephony solutions offer 
wide-ranging price/performance alternatives to fit your business needs today 
and tomorrow. 3Com® SuperStack® 3 NBX® Networked Telephony Solution Delivers 
robust, full-featured business communications for up to 1500 devices 
(lines/stations) Ensures high system availability with the Wind River VxWorks 
real-time operating system (also used in pacemakers and artificial hearts), so 
server and PC downtime does not impact your telephone service. 

Exploit: It was possible to make the remote Virata-EmWeb/R6_0_3 server (the NBX 
Netset application) crash by running a standard nessus scan in safeChecks mode. 
 Note: Saftchecks mode only does web queries, XSS, etc..

The 3com NBX uses VXWORKS Embedded Real time Operating system and what appears 
to be Virata-EmWeb/R6_0_3 web server.  this web server is used by the NetSet 
configuration program to update/reboot/backup/configure and check status on the 
3com NBX VPIO call manager.  It is also used by each phone user to change speed 
dial numbers, configure call forwarding and other features of their individual 
phone sets.  By running the nessus vulnerabilities scanner, in safeChecks mode, 
a hacker or user can disable the Netset status, Call detail functions, 
maintenance functions, including the ability to 'soft boot' system.  Note: you 
may still be able to connect a 9600 baud terminal to the 3com NBX Call Manager 
and soft boot system, but this requires physical access and would need to be 
done each and every time someone ran nessus.  Also note, that with the 
proliferation of web based attacks on the net lately, and the fact that the 
nessus tests are just a 'safe' version of these exploits, thi!
 s creates a serious problem for the NBX.

Also note, that the NBX is NOT SIP, but rather uses 3com proprietary multi-cast 
protocol, an enterprise that deploys the 3com VOIP NBX system and expects to 
use the functions on a remote phone must either use a Multicast VPN router 
(rare and expensive), or place the NBX on the outside of the firewall.  Also, 
there is no ability to keep hackers and crackers from connecting to the 
'open/bare' nbx call manager web port via ip access control lists on the nbx.  
A quick google search will find several 3com nbx systems with the Call manager 
exposed.

http://ipphone.cybertown.co.at/
http://telephone.michiganaerospace.com/
http://nbxss3.shoreschool.org/

This condition is not recovered without a Hard reboot (power off/on). Since the 
3com nbx is based on an embedded Unix operating system (vxworks), an abrupt 
power off could cause loss of data, including corruption of voice mails in 
progress or logs. 

A company who uses the VoIP features for remote locations, and who has the call 
manager located on the outside of their firewall, or has no firewall can have 
their VOIP management functions disrupted easily. Even if the company has call 
manager located on internal network, people with internal network access can 
also disrupt communications. 

We have tested 3com nbx firmware version 4_2_7 (with embedded web server 
Virata-EmWeb/R6_0_3).

3com should have had in place the ability to test their new software versions 
in QA, especially since they know, or should know that these systems can be 
exposed to attack from the internet.  3com has known since at least October 
2002 when we informed them of the security problems with the built in ftp 
server.  We have asked 3com several times since then for updated copies of the 
firmware to address the problem, and for us to test but have not had a response 
from 3com since December, 2002.

See http://www.secnap.com/security/nbx001.html for details of previous DOS 
problems with 3com nbx system)

Update/Workaround:  no workaround found.  No way to change the default port to 
'hide' this vulnerable server.  Place server on VLAN and restrict access.  Do 
not use NBX VOIP for remote offices or phones unless you have a MultiCast 
capable VPN or private VPN.

3com Response: None

Solution: 
Please contact vendor for new firmware when they fix it.

For a report on Security Risk Factors with IP Telephony based Networks 
see: 
Security_Risk_Factors_with_IP_Telephony_based_Networks Also reference article 
"is VoIP vulnerable ?"on NWfusion.com 
http://www.nwfusion.com/news/2002/0624voip.html 

see "Firewall limits vex VoIP users" at Nwfusion 
http://www.nwfusion.com/news/2002/0625bleeding.html 

For earlier problems with 3com NBX, ftp denial of service attack, see 
http://www.secnap.com/security/nbx001.html
Credit: 
This problem was originally found during a routine security audit by Michael 
Scheidell, SECNAP Network Security, www.secnap.com using the Nessus 
vulnerabilities scanner, www.nessus.org., 

Additional Information: 

To test your systems for this vulnerability, you can use Nessus at 
www.nessus.org. 
Select default scan runs.

Original copy of this report can be found here 
<http://www.secnap.net/security/20040420.html> 

Copyright: 
Above Copyright(c) 2004, SECNAP Network Security Corporation. World rights 
reserved. 

This security report can be copied and redistributed electronically provided it 
is not edited and is quoted in its entirety without written consent of SECNAP 
Network Security Corporation. Additional information or permission may be 
obtained by contacting SECNAP Network Security at 561-368-9561 or www.secnap.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html