-- Corsaire Security Advisory --

Title: Mitel 3300 ICP web interface DoS issue
Date: 17.08.04
Application: Mitel Web Management Interface 
Environment: Mitel 3300 ICP (prior to 5.2)
Author: Stephen de Vries [stephen@corsaire.com]
Audience: General distribution
Reference: c040817-003


-- Scope --

The aim of this document is to define a vulnerability in the 3300 
Integrated Communication Platform as supplied by Mitel [1], that allows 
an authenticated user to deny access to other users of the web 
management interface.


-- History --

Discovered: 17.08.04 (Stephen de Vries)
Vendor notified: 27.08.04
Document released: 28.02.05


-- Overview --

The 3300 ICP [2] provides enterprise IP-PBX capabilities and makes use 
of a Web Interface to manage the device.  In order to maintain a user 
session, the Web Interface generates a unique session ID for each user 
after they have successfully authenticated.  Once the client has 
authenticated, this session ID is used as a shared secret to 
authenticate the client to the server for all subsequent requests. 
The Web Interface has an upper limit of 50 active session IDs.  A 
malicious user could authenticate 50 times and thereby deny access to 
the Web Interface for other users. The scope of this attack is limited 
to users with access to valid authentication credentials, or who exploit 
another vulnerability to gain access to a valid session.


-- Analysis --

Session IDs are generated after authentication and valid sessions are 
disposed of when the user logs out, or when the browser window is 
closed.  Authentication can be performed by an HTTP POST request to the 
URL: http://<Controller_IP>/esm_validate.asp and using the variables: 
hiddenUid and hiddenPwd for the username and password respectively.  By 
authenticating 50 times without logging out, the available session IDs 
are exhausted and subsequent authentication requests are denied.  This 
prevents legitimate users from accessing the web interface. Sessions 
remained active for more than 1 hour, this means that the denial of 
service condition lasts for at least 1 hour without having to re-launch 
the attack. 


-- Recommendations --

The vendor has released a revised version of the software that does not 
exhibit this issue. This has not been independently verified by 
Corsaire.


-- CVE --

The Common Vulnerabilities and Exposures (CVE) project has assigned the 
name CAN-2004-0945 to this issue. This is a candidate for inclusion in 
the CVE list (http://cve.mitre.org), which standardises names for 
security problems.


-- References --

[1] http://www.mitel.com
[2] http://www.mitel.com/DocController?documentId=9555&c=9511&sc=9514


-- Revision --

a. Initial release.
b. Minor revision.
c. Revised affected product version.


-- Distribution --

This security advisory may be freely distributed, provided that it 
remains unaltered and in its original form. 


-- Disclaimer --

The information contained within this advisory is supplied "as-is" with 
no warranties or guarantees of fitness of use or otherwise. Corsaire 
accepts no responsibility for any damage caused by the use or misuse of 
this information.


-- About Corsaire --

Corsaire are a leading information security consultancy, founded in 1997 
in Guildford, Surrey, UK. Corsaire bring innovation, integrity and 
analytical rigour to every job, which means fast and dramatic security 
performance improvements. Our services centre on the delivery of 
information security planning, assessment, implementation, management 
and vulnerability research. 

A free guide to selecting a security assessment supplier is available at 
http://www.penetration-testing.com 


Copyright 2004 Corsaire Limited. All rights reserved.