Vulnerable Systems:
* OmniPCX Enterprise all versions prior to R9.0
* OmniPCX Enterprise release R9.0 all versions prior to patch H1.301.50 (excluded)
* OmniPCX Enterprise release R9.0 H1.301.50 and more recent.
* OmniPCX Enterprise release R9.1 and later.
Alcatel-Lucent's OmniPCX Enterprise Communication Server could allow an attacker to execute arbitrary code with the privileges of the affected service.
The Alcatel-Lucent OmniPCX Enterprise Communication Server (CS) is used to process, manage, and log traditional as well as VOIP based telephony. Part of the maintenance functionality consists of a web based administrative interface consisting of various CGI and PHP based scripts. The vulnerability occurs in the handling of multiple CGI applications that make up the web application.
The vulnerability occurs when parsing certain HTTP headers. String based data from the HTTP request is improperly validated, which can result in a trivial stack based buffer overflow.
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service, usually the user 'mtcl'. This user is not equivalent to root, but does have access to most of the files used for managing the OXE system.
The OXE environment consists of a custom Linux distribution. It doesn't employ any of the modern exploit mitigation defenses like ASLR or NX. As such, this vulnerability is trivial to exploit reliably.
Patch Availability:
An official fix is available for customers through Alcatel-Lucent Business Partners since mid january on their support website. An Alcatel-Lucent security advisory is available on: www.alcatel-lucent.com/security/psirt
Workaround:
The embedded web server can be deactivated by using the netadmin command. The steps to perform this are documented in the following location of the administration guide: 11.Security > 11.9.Web server configuration > 11.9.1.Deactivate the Web server, then apply your change. This will remove all functionality provided by the web server, but has no impact on the normal system operation.
