Polycom ViewStation Unlimited Telnet Login Attempts Vulnerability

Bugtraq ID:	5635
Class:	Design Error
CVE:	CVE-2002-0628
Remote:	Yes
Local:	No
Published:	Sep 04 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovery of this issue is credited to Jeff Horne of the ISS X-Force.
Vulnerable:	Polycom ViewStation V.35 7.2 Polycom ViewStation V.35 6.5.1 Polycom ViewStation SP/SP384 7.2 Polycom ViewStation SP/SP384 6.5.1 Polycom ViewStation MP 7.2 Polycom ViewStation MP 6.5.1 Polycom ViewStation H.323 7.2 Polycom ViewStation H.323 6.5.1 Polycom ViewStation FX/VS 4000 4.1.5 Polycom ViewStation DCP 7.2 Polycom ViewStation DCP 6.5.1 Polycom ViewStation 512 7.2 Polycom ViewStation 512 6.5.1 Polycom ViewStation 128 7.2 Polycom ViewStation 128 6.5.1
Not Vulnerable:	Polycom ViewStation FX/VS 4000 4.2

Polycom ViewStation Unlimited Telnet Login Attempts Vulnerability

Polycom ViewStation does not restrict the number of login attempts that may be made via the Telnet service. This will allow remote attackers to make an unlimited number of brute-force attacks when attempting to compromise a vulnerable device.

Polycom ViewStation Unlimited Telnet Login Attempts Vulnerability

There is no exploit code required.

Polycom ViewStation Unlimited Telnet Login Attempts Vulnerability

Solution:
This issue has been addressed in ViewStation FX/VS4000 4.2. Fixes for other products are scheduled for later release. Those affected by this issue should contact the vendor about obtaining fixes.

Polycom ViewStation Unlimited Telnet Login Attempts Vulnerability

References:

• Multiple Remote Vulnerabilities in Polycom Videoconferencing Products (Internet Security Systems )
  
• Polycom Worldwide Resource Center (Polycom)