var-201407-0034
Vulnerability from variot
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. Yealink VoIP Phone The firmware of CRLF An injection vulnerability exists. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Yealink VoIP Phones are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. I. BACKGROUND
Yealink is a manufacturer of VoIP and Video products. To minimize noise read more at:
http://www.yealink.com/Companyprofile.aspx
III. Validated on
Firmware Version 28.72.0.2 Hardware Version 28.2.0.128.0.0.0
CRLF Injection (Header Splitting) proof of concept:
Request GET /servlet?linepage=1&model=%0d%0a%20 ANYTHING I WANT GOES HERE &p=dsskey&q=load HTTP/1.1
In the above request, attackers can shove in code, webpages, etc. In my tests, I have used javascript, redirects, and even an entire web page shoved into the CRLF vulnerable inputs.
The XSS vulnerability
GET /servlet?jumpto=dsskey&model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22&p=login&q=loginForm HTTP/1.1
Typical Cross Site Scripting.
IV. SOLUTION
Minimize accessibility to the phone's interface.
V. VENDOR CONTACT AND RESPONSE
05/08/2014 E-mailed security@yealink.com (bounced) 05/08/2014 Created an account on Yealink's forum and sent message (no response for weeks) 05/26/2014 Response via e-mail from Yealink 05/26/2014 Replied to vendor I would disclose in June 06/01/2014 Reached back out to vendor for update 06/08/2014 Reached back out to vendor for update 06/11/2014 Rouched out one last time... Crickets 06/12/2014 Advisory
VI. TOOLS USED
Burpsuite, WVS, Firefox
-- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM
"Where ignorance is our master, there is no possibility of real peace" - Dalai Lama
42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0034",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "voip phone",
"scope": "eq",
"trust": 2.4,
"vendor": "yealink",
"version": "28.72.0.2"
},
{
"model": "voip phone",
"scope": "eq",
"trust": 0.8,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "hardware",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.2.0.128.0.0.0"
},
{
"model": "yealink",
"scope": "eq",
"trust": 0.3,
"vendor": "yealink",
"version": "28.72.0.2"
}
],
"sources": [
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:yealink:voip_phone",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:yealink:voip_phone_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jesus Oquendo",
"sources": [
{
"db": "BID",
"id": "68022"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 1.0
},
"cve": "CVE-2014-3427",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2014-3427",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-71367",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-3427",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-3427",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201406-642",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-71367",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet. Yealink VoIP Phone The firmware of CRLF An injection vulnerability exists. Supplementary information : CWE Vulnerability type by CWE-93: Improper Neutralization of CRLF Sequences (CRLF injection ) Has been identified. Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. \nAn attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Yealink VoIP Phones are IP phone products of China YeaLink Company. The product supports caller avatar display, call recording and anonymous calling, etc. \nI. \tBACKGROUND\n\nYealink is a manufacturer of VoIP and Video products. To\nminimize noise read more at:\n\nhttp://www.yealink.com/Companyprofile.aspx\n\n\nIII. Validated on \n\nFirmware Version 28.72.0.2\nHardware Version 28.2.0.128.0.0.0\n\nCRLF Injection (Header Splitting) proof of concept:\n\nRequest\nGET /servlet?linepage=1\u0026model=%0d%0a%20 ANYTHING I WANT GOES HERE \u0026p=dsskey\u0026q=load HTTP/1.1\n\nIn the above request, attackers can shove in code, webpages,\netc. In my tests, I have used javascript, redirects, and even\nan entire web page shoved into the CRLF vulnerable inputs. \n\n\n-----\n\n\nThe XSS vulnerability\n\nGET /servlet?jumpto=dsskey\u0026model=%22%20onmouseover%3dprompt%28 1337 %29%20badpuppy%3d%22\u0026p=login\u0026q=loginForm HTTP/1.1\n\nTypical Cross Site Scripting. \n\n\nIV. \tSOLUTION\n\nMinimize accessibility to the phone\u0027s interface. \n\n\nV. \tVENDOR CONTACT AND RESPONSE\n\n05/08/2014\tE-mailed security@yealink.com (bounced)\n05/08/2014\tCreated an account on Yealink\u0027s forum and\n\t\tsent message (no response for weeks)\n05/26/2014\tResponse via e-mail from Yealink\n05/26/2014\tReplied to vendor I would disclose in June\n06/01/2014\tReached back out to vendor for update\n06/08/2014\tReached back out to vendor for update\n06/11/2014\tRouched out one last time... Crickets\n06/12/2014\tAdvisory\n\n\nVI. \tTOOLS USED\n\nBurpsuite, WVS, Firefox\n\n\n\n-- \n=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+\nJ. Oquendo\nSGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM\n\n\"Where ignorance is our master, there is no possibility of\nreal peace\" - Dalai Lama\n\n42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF\nhttp://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2BF7D83F210A95AF\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3427"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "PACKETSTORM",
"id": "127081"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71367",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-3427",
"trust": 2.9
},
{
"db": "PACKETSTORM",
"id": "127081",
"trust": 1.2
},
{
"db": "BID",
"id": "68022",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642",
"trust": 0.7
},
{
"db": "EXPLOIT-DB",
"id": "39334",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-71367",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"id": "VAR-201407-0034",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:59:40.303000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.yealink.com/index.aspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/jun/74"
},
{
"trust": 1.4,
"url": "http://www.securityfocus.com/archive/1/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/532410/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://packetstormsecurity.com/files/127081/yealink-voip-phones-xss-crlf-injection.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3427"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3427"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68022"
},
{
"trust": 0.3,
"url": "www.yealink.com"
},
{
"trust": 0.1,
"url": "http://www.yealink.com/companyprofile.aspx"
},
{
"trust": 0.1,
"url": "http://pgp.mit.edu:11371/pks/lookup?op=get\u0026search=0x2bf7d83f210a95af"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3428"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3427"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-71367"
},
{
"db": "BID",
"id": "68022"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"db": "PACKETSTORM",
"id": "127081"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-16T00:00:00",
"db": "VULHUB",
"id": "VHN-71367"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68022"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"date": "2014-06-13T00:12:49",
"db": "PACKETSTORM",
"id": "127081"
},
{
"date": "2014-06-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"date": "2014-07-16T14:19:02.997000",
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-71367"
},
{
"date": "2014-06-12T00:00:00",
"db": "BID",
"id": "68022"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003364"
},
{
"date": "2014-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-642"
},
{
"date": "2024-11-21T02:08:04.393000",
"db": "NVD",
"id": "CVE-2014-3427"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yealink VoIP Phone In the firmware CRLF Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003364"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-642"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.