Monthly Archives: May 2016

3CX, Phone System, Service Pack 3, v14

Insecure RC4 Cipher Suites and 56-bit encryption Enabled in 3CX V14 SP3

Leave a comment

RC4 cipher suite is still enabled in Abyss Web Server X2 (Version 2.9.3.6) that is supplied with 3CX Version 14 Service Pack 3.

Version 2.11 of Abyss Web server X2 that was released on 5th April 2016 disabled the obsolete RC4 cipher suite as per RFC7465.
 
Abyss Web Server X2 in 3CX Version 14 Service Pack 3 also negotiates TLS_RSA_WITH_DES_CBC_SHA which is only a 56-bit key and is considered insecure.
3CX support have provided a workaround for this
You may edit the ciphers configured in Abyss by doing the following:
– on 3CX server, open a browser and go to http://127.0.0.1:9999, login with admin/admin
– change Ciphers dropdown to “Custom Ciphers Specification”
– replace RC4-SHA:HIGH:MEDIUM:LOW:DEFAULT:-EXP:!SSLv2:!ADH:!aNULL:!eNULL:!NULL
with HIGH:MEDIUM:LOW:DEFAULT:-EXP:!SSLv2:!ADH:!aNULL:!eNULL:!NULL:!TLS_RSA_WITH_DES_CBC_SHA:!RC4:!DES-CBC-SHA
– validate, clicking OK on each screen until you are back to the webserver homepage then click Restart button.
3CX, Phone System, Service Pack 3, v14

Outdated and vulnerable PostgreSQL version 9.2.4 used in 3CX V14 SP3

Leave a comment

3CX Version 14 Service Pack 3 seems to include/use a very old and insecure PostgreSQL version 9.2.4 (released 04-04-2013).

There have been at least 13 releases since 9.2.4, the latest being 9.2.17 which have resolved the following vulnerabilities: CVE-2014-0066, CVE-2014-0065, CVE-2014-0064, CVE-2014-0063, CVE-2014-0062, CVE-2014-0061, CVE-2014-0060, CVE-2014-0067, CVE-2014-8161, CVE-2015-0244, CVE-2015-0243, CVE-2015-0242, CVE-2015-0241, CVE-2015-3167, CVE-2015-3166, CVE-2015-3165, CVE-2015-5288 and CVE-2016-0773
This means that 3CX V14 Service Pack 3 is likely to be vulnerable to all of the above vulnerabilities.  Using an IPS firewall may help to reduce the risk to your system until an updated version of PostgreSQL is integrated into 3CX.