RPRM - Multiple Vulnerabilities

Summary

CVE-2015-4681

Poly RealPresence Resource Manager 8.3.2 and earlier contains instances of weak passwords.

CVE-2015-4682

An absolute path disclosure vulnerability in Poly RealPresence Resource Manager 8.3.2 and earlier allows an attacker to see the path to the web root. This information leakage can be used to refine attacks against the webserver.

CVE-2015-4683

Poly RealPresence Resource Manager 8.3.2 and earlier transmits session-IDs as a URL parameter, which can be used by an unprivileged attacker to gain admin-level privileges.

CVE-2015-4684

Poly RealPresence Resource Manager 8.3.2 and earlier allow remote authenticated administrator users to read or write arbitrary files.

CVE-2015-4685

Poly RealPresence Resource Manager 8.3.2 and earlier contains a sudo misconfiguration that could allow an attacker to escalate their privileges.

Plaintext passwords stored in logfiles

RPRM generates log data which includes plaintext passwords. This weakness in combination with the previous vulnerability allows an unprivileged attacker to escalate his privileges to the admin level in the web interface. The “previous vulnerability” mentioned by SEC Consult has been fixed in RPRM 8.4. Only users with administrator or auditor role can read the affected logs. Poly is working on the issue and will soon release an update to address this.

Weak/Missing Authorization

The separation of users relies on the fact that conference IDs are not guessable, but as soon as an information disclosure vulnerability allows an attacker to gather conference IDs authorization can be bypassed. The arbitrary file download vulnerability (2) allows an attacker to collect valid conference IDs. The “arbitrary file download vulnerability” mentioned by SEC Consult has been fixed in RPRM 8.4. Only users with an administrator or auditor role can read logfiles that contain valid conference IDs. Poly is working on the issue and will soon release an update to address this.