Multiple vulnerabilities in several IP camera products ====================================================== [ADVISORY INFORMATION] Title: Multiple vulnerabilities in several IP camera products Release date: 08/06/2011 Last update: 08/06/2011 Credits: Roberto Paleari, Emaze Networks S.p.A (roberto.paleari@emaze.net) [VULNERABILITY INFORMATION] Class: Hidden functionalities, command-injection, weak encryption [AFFECTED PRODUCTS] The vulnerabilities described in this advisory are related to a firmware shared among several devices of different vendors. Unfortunately, we have not been able to identify the actual firmware manufacturer: we asked the name of the firmware manufacturer to the vendors, without any success (see section "DISCLOSURE TIME-LINE" for details). We confirm the products of the following vendors are affected: * TRENDnet * Digicom * iPUX We speculate some IP camera products of the following vendors are also affected: * ZoneNet * AirLink101 Other products we are not aware of could also be vulnerable to these issues. [VULNERABILITY DETAILS] The firmware running on the affected IP cameras is subject to multiple security issues that allow an attacker to gain administrative access to the device and to execute arbitrary commands. In the following paragraphs we describe the details of the vulnerabilities we identified. a) Undocumented user A user can authenticate to the web server running on the device using the credentials "productmaker:ftvsbannedcode". The "productmaker" user can access to a restricted number of web pages (basically, all the pages under the "/cgi/maker/" directory). b) Command-injection vulnerabilities Some of the web pages the "productmaker" can access to are subject to a command-injection vulnerability, as the server-side script does not properly validate user-supplied input. The following URL exploits a command-injection vulnerability inside "unittest.cgi" page. The payload executes the "ls" command and displays its output inside the generated web page: http://<device IP address>/cgi/maker/unittest.cgi?action=asd;ls;date>/dev/null A similar issue also affects the "sn.asp" page. c) Hidden Telnet service The "productmaker" user can enable a Telnet server by accessing the following web page: http://<device IP address>/cgi/maker/tools.cgi?telnet=1 The page spawns a Telnet daemon listening on TCP port 23. The Telnet daemon does not require any authentication. d) Weak password encryption User passwords are stored in "/server/usr.ini", and are simply encoded in base64 form. e) Configuration encoding Users can backup the configuration of the device through the web interface. The configuration is saved in a tgz file ("config.cfg") that is "encrypted" in a easy-to-reverse form. The following Python procedure decodes the "encrypted" version of the configuration file: # 'data' is the content of the encrypted configuration file, as downloaded # from the web interface def conf_decode(data): r = "" for c in data: x = ord(c) ^ ord('j') x = (~x) & 0xff r += chr(x) return r To encode a plain tgz file into a valid configuration archive, just apply the inverse of the "conf_decode" procedure. [UNAUTHORIZED ACCESS TO THE DEVICE] By leveraging the aforementioned vulnerabilities, an attacker can easily obtain the authentication credentials for the "admin" user as follows: 1. Authenticate as the hidden "productmaker" user. 2. Exploit the command-injection vulnerability to obtain the content of the /server/usr.ini file. 3. The web server replies with the password for the "admin" user, encoded in base64. [REMEDIATION] We are not aware of an updated firmware that corrects the issues described in this advisory. In the meanwhile, users can modify the default credentials for the user "productmaker", in order to inhibit unauthorized accesses to the device. At this aim, users should perform the following actions: 1. Perform a backup of the configuration of the device. 2. Decode the configuration file (see point 'e' in the previous section). 3. Modify the config/server/usr.ini file inside the tgz archive, and replace the password for the "maker" user with a new one. 4. Rebuild the tgz archive and encode it. 5. Upload the new configuration file to the device. A Python script that automates these steps can be provided upon request. [DISCLOSURE TIME-LINE] We tried to contact two different vendors. Below we report the time-lines: = VENDOR A = * 07/03/2011 - The author contacts vendor A, asking for details about the firmware manufacturer. * 07/03/2011 - First reply from vendor A, asking for vulnerability details. * 08/03/2011 - The author informed vendor A about his intention to publicly disclose the details of the security issues after the release of proper countermeasures. * 16/03/2011 - No response from the vendor. The author re-sent the previous e-mail. * 29/03/2011 - Still no reply from the vendor. The author re-sent the e-mail again. * 21/04/2011 - Again, no reply from the vendor. The author re-sent the e-mail. * 08/06/2011 - Disclosure. = VENDOR B = * 06/06/2011 - The author contacts vendor B, asking for details about the firmware manufacturer. * 06/06/2011 - Vendor B replies he is not interested into fixing these security issues. * 07/06/2011 - The author informs vendor B about his intention to disclose the details of the issues. * 08/06/2011 - Disclosure. [COPYRIGHT] Copyright(c) Emaze Networks S.p.A 2011, All rights reserved worldwide. Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact. Emaze Networks has updated ipLegion, its vulnerability assessment platform, to check for this vulnerability. Contact info@emaze.net to have more information about ipLegion. [DISCLAIMER] Emaze Networks S.p.A is not responsible for the misuse of the information provided in our security advisories. These advisories are a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice.