CVE-2015-4685

Vulnerability

The vulnerability exists in Polycom RealPresence Resource Manager (RPRM) versions before 8.4. A local user with access to the plcm account can exploit a sudo misconfiguration to execute arbitrary scripts located in /var/polycom/cma/upgrade/scripts with elevated privileges. This configuration flaw allows the plcm user to run scripts without proper authentication controls, leading to privilege escalation [1][2].

Exploitation

To exploit this flaw, an attacker must have local access to the system and be able to authenticate as the plcm user. Once logged in, the attacker can craft a malicious script or use existing scripts in the /var/polycom/cma/upgrade/scripts directory. Due to the sudo misconfiguration, the attacker can execute these scripts with root privileges without needing to provide a password for sudo [1][2].

Impact

Successful exploitation grants the attacker full root access to the RPRM appliance. This can lead to complete compromise of the system, including the ability to steal conference passcodes, join or record conferences, and potentially disrupt services. The impact is critical as it allows an attacker with limited local access to gain unrestricted control over the resource manager [1][2].

Mitigation

Polycom released version 8.4 to address this vulnerability. Users should upgrade to version 8.4 or later immediately. No workarounds have been published, and the vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].