Polycom Products Directory Traversal and Command Injection Vulnerabilities

Bugtraq ID:	52301
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 05 2012 12:00AM
Updated:	Feb 13 2013 09:01AM
Credit:	João Paulo Caldas Campello
Vulnerable:	Polycom Web Management Interface G3/HDX 8000 HD Polycom Linux Development Platform 2.14.g3 Polycom HDX Video End Points 2.6 Polycom HDX 8000 0 Polycom Durango 2.6 build 4740 Polycom Durango 2.6
Not Vulnerable:	Polycom UC APL 2.7.1.J Polycom HDX Video End Points (commercial) 3.0.4 Polycom HDX Video End Points 3.0

Polycom Products Directory Traversal and Command Injection Vulnerabilities

Multiple Polycom products are prone to a directory-traversal vulnerability and a command-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Also, attackers can execute arbitrary commands with the privileges of the user running the application.

Polycom Products Directory Traversal and Command Injection Vulnerabilities

Attackers can exploit these issues through a browser.

The following example exploits are available:

For the directory traversal vulnerability:
http://www.example.com/a_getlog.cgi?name=../../../etc/passwd

For the command injection vulnerability:
127.0.0.1 ; ps -ef > /tmp/command_injection.txt #

• /data/vulnerabilities/exploits/52301.rb

Polycom Products Directory Traversal and Command Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Polycom Products Directory Traversal and Command Injection Vulnerabilities

References:

• Path Traversal and O.S. Command Injection vulnerabilities in Polycom products (João Paulo Caldas Campello)
  
• Path Traversal on Polycom Web Management Interface (tempest.blog)
  
• Polycom Homepage (Polycom )
  
• Polycom Web Management Interface O.S. Command Injection (tempest.blog)