Vulnerable Systems:
*Aastra 6753i IP Telephone 3.2.2.56
The issue is due to the software using a slightly modified 3DES algorithm in ECB mode to protect the file. Configuration files are typically encrypted using the same key, allowing for an attacker to gain access to a .tuz configuration file to compare them to determine differences in payload. Slight differences in ciphertext will denote information that changes, such as a username or password. By copying the encrypted block from one configuration to another, an attacker can use the device to decrypt arbitrary configuration pieces. Note, this issue is dependent upon an attacker finding a way to get access to the configuration file (e.g. sniffing, accessing the TFTP server where configurations are fetched from).
Disclosure Timeline:
Discovery Date :2012-02-01
Vendor Informed Date :2012-02-02
Vendor Ack Date :2012-02-03
Disclosure Date :2013-01-03
