Plantronics + Polycom. Now together as Poly Logo

posting / uploading private key is a security vulnerability

pocock
Occasional Advisor

posting / uploading private key is a security vulnerability

 

Technical Bulletin TB37148 describes the way Polycom phones are submitted Certificate Signing Requests (CSR) through the web / provisioning server.

 

In step 3, on page 7, it states "A message ‘CSR generation completed’ displays on the phone’s screen. The CSR file (<MAC
Address>.csr) and the private key file (<MAC Address >-private.key) are uploaded to the provisioning server. The public key (the other part of the key pair generated by the phone) is included in the CSR."

 

I tested this workflow and observed that the phone really does try to send the private key to the web server.

 

a) sending the private key out of the phone is a security risk.  It could be sniffed by a man-in-the-middle or a proxy server.  Copies of the key may be accidentally left on the web server, some administrators may not even realize they are there, because no other correctly implemented CSR workflow does anything like this, it is completely unexpected behavior

 

b) it is not necessary to send the private key to the server anyway - all the information needed to create a certificate is actually included in the CSR.  Only the CSR should be sent to the web server.

 

 

Message 1 of 4
3 REPLIES 3
pocock
Occasional Advisor

Re: posting / uploading private key is a security vulnerability

 

Is anybody able to comment on this issue?  Is there any workaround or will it be fixed in the next firmware releases?

Message 2 of 4
SteffenBaierUK
Polycom Employee & Community Manager

Re: posting / uploading private key is a security vulnerability

Hello pockock ,

this was internally raised via VOIP-121344 and will be added to future software versions.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

----------------
The title Polycom Employee & Community Manager is a community setting and does not reflect my role. I am just a simple volunteer in the community like everybody else. My official "day" Job is 3rd Level support at Poly but I am unable to provide official support via the community.

----------------

Notice: This community forum is not an official Poly support resource, thus responses from Poly employees, partners, and customers alike are best-effort in attempts to share learned knowledge. If you need immediate and/or official assistance please open a service ticket through your proper support channels.
Please also ensure you always check the VoIP , Video Endpoint , Skype for Business , PSTN or RPM FAQ's
Message 3 of 4
pocock
Occasional Advisor

Re: posting / uploading private key is a security vulnerability

 

As well as fixing this issue, could you ask the developers to automatically fill out the CN field in the CSR form?  It would be really convenient to have the MAC address appear automatically.  As it relates very closely to this issue, it can probably be implemented and tested as part of the same release cycle.

Message 4 of 4