OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6

From: Stefan Kanthak (stefan.kanthaknexgo.de)
Date: Mon May 06 2013 - 08:30:42 CDT

Hi ll,

the current 3CXPhone6.msi (for Windows), available from
<http://www.3cx.com/VOIP/sip-phone/>, digitally signed on 2012-07-30,
installs the following outdated and vulnerable 3rd-party libraries:

* libeay32.dll and ssleay32.dll version 0.9.8h (from 2008-05-28)
  of OpenSSL.

  The current version of OpenSSL is 0.9.8y, see
  <http://www.openssl.org/>, it fixes about 20 CVEs found in earlier
  versions downto 0.9.8h.

* FFmpeg/FFdshow version 1.1.0

  The current version of FFmpeg/FFdshow is 1.2, see
  <http://www.ffmpeg.org/security.html> for the 24 fixed CVEs since
  1.1.0.

Timeline:
~~~~~~~~~

2013-05-03 vendor informed

2013-05-05 vendor replied:
              "3CX Phone is freeware, use another software"

I second that: don't use software from 3CX!

2013-05-06 report published

Stefan Kanthak

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/