-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-011 Product: Alcatel-Lucent ALE DeskPhones Manufacturer: ALE International, ALE USA Inc Affected Version(s): Please see the manufacturer note[4] Tested Version(s): Firmware Versions: 86x8_NOE-R300.1.40.07.4140 86x8_SIP-R200.1.01.10.728 86x8_NOE-R300.1.40.12.4180 Vulnerability Type: Improper Privilege Management (CWE-269) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2024-02-19 Solution Date: 2024-05-06 Public Disclosure: 2024-05-06 CVE Reference: CVE-2024-29150 Author of Advisory: Moritz Abrell, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: ALE DeskPhones are modern desk phones which are used for the operation in enterprise environments. The manufacturer describes the product as follows (see [1]): "Innovative deskphones and digital phones, delivering rich communications in sleek designs, are essential for hybrid work." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: Due to improper privilege management, an authenticated attacker is able to create symlinks to sensitive and protected data in locations which are part of debugging files. Given that the process of gathering debug logs is carried out with root privileges, any file referenced in the symlink is consequently written to the debug archive, thereby granting accessibility to the attacker. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Create a symlink to sensitive and protected data at the location "/data/core" on the phone with "admin" access (e.g. via SSH or via USB debugging (UART)): $ ln -s /config-fab/fabconfig/cert/cert.pem /data/core/cert.pem $ ln -s /config-fab/fabconfig/cert/pkey.pem /data/core/pkey.pem 2. Plug-in a FAT32 formated USB drive to the phone. 3. Executing the debug process on the phone. This can be done e.g. via the UI function "Maintenance/Debug/Get logs" 4. The files referenced in the symlinks are stored on the USB drive. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Update the devices according to the manufacturer note[4]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2024-02-17: Vulnerability discovered 2024-02-19: Vulnerability reported to manufacturer 2024-02-19: Manufacturer confirmed reception 2024-03-04: Asked the manufacturer for status 2024-03-18: CVE-2024-29150 assigned and shared with the manufacturer 2024-03-25: Asked the manufacturer for status 2024-03-28: Update from the manufacturer: Case is still under investigation 2024-03-29: Update form the manufacturer: A fix proposal is made 2024-04-02: Asked the manufacturer for a proposed remediation timeline 2024-04-02: Update from the manufacturer: Manufacturer has reproduction issues 2024-04-02: Proposed a meeting to discuss technical details 2024-04-03: Video call with the manufacturer to discuss technical details 2024-04-02: Update from the manufacturer: Root cause has now been fully understood and a fix is under testing Manufacturer has questions about the details and timeline of the disclosure 2024-04-10: Video call with the manufacturer to discuss the disclosure timeline 2024-04-11: Disclosure timeline proposed and shared with the manufacturer 2024-05-06: Update from the manufacturer: A security advisory will be published today 2024-05-06: Manufacturer published a security advisory[4] 2024-05-07: Public disclosure 2024-07-12: Advisory updated with technical details 2024-07-12: Blog post published[5] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] ALE DeskPhones product website https://www.al-enterprise.com/en/products/devices/ale-deskphones [2] SySS Security Advisory SYSS-2024-011 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-011.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] Security advisory published by the manufacturer https://www.al-enterprise.com/-/media/assets/internet/documents/n-to-s/sa-c0071-ed01.pdf [5] Blog post: https://blog.syss.com/posts/voip-deskphone-firmware-security/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Moritz Abrell of SySS GmbH. E-Mail: moritz.abrell@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Abrell.asc Key Fingerprint: 2927 7EB6 1A20 0679 79E9 87E6 AE0C 9BF8 F134 8B53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmZpQcIACgkQrgyb+PE0 i1Pkvg//UEn7uLz/F19ermeiQFt3JjN30p6HU2nGjJj5HtC8k51AYqkDOfzYcIwq weMgU//s+H4Nu7l9Qn1k+IIAU6bhBNCoYfpSH3tW53QCdfXcrVkhYXdh09lJhp7f pqg5L4Rlrk8td8KYdrlzVA13Y8jz6B8Zx4F8um6rVlxt8JiNKZKFmJx9jdIGehzA Z1KOJrzPUrXuQ56iUIaawEwLWR6cgYk+cDQLdsDhlhNavDUv71aegE2A3EaCjIvK zvJc8VT61XePT3NiMgctg1ScfAqV39FEi8XEiOi+kr9aahdlelBYXkBf8vHa282y XRtBV3xsbTi7AThVLT+V9+2QjpAWK56BVk3Cb42xPoiCzqIa7B8Rc2d83B+C94/1 X34MpiBGzyDPvO0yvllpDKvwg+OYiRxUTMmftDeAtAj+6Tx4UK3UfUPulZ0EDmDm 144lkTyj3AMTJLCLn8XUGeaLSCdyChqKbYH3E2+s1KtTWns9TE5TT/iwwK0Eoe6b /NWYMu/qFOXFXrYmNeRRrmGLtVIlywddYp4/F06Ss/lXlYLYwj7acUMWeISydR99 PD249A27xpBR11ZDkt+gXqHvxqgH8Z+eFe9S86CQK38a4GysCsqANJr9H6n2ePrG CVKe1d/HdCgOBGlawru/+wuytpEZRVzaB8fsLi8fdrWUz5qOkgg= =4gLn -----END PGP SIGNATURE-----