7.6 High
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.007 Low
EPSS
Percentile
80.3%
Samsung Web Viewer for Samsung DVR contains multiple vulnerabilities including: Cleartext Storage in a File or on Disk (CWE-313) and Authentication Bypass by Assumed-Immutable Data (CWE-302).
CWE-313**: Cleartext Storage in a File or on Disk -**CVE-2013-3585
Web Viewer for Samsung DVR stores user credentials in plaintext allowing an attacker to parse saved credentials on the user setup webpage.
CWE-302**: Authentication Bypass by Assumed-Immutable Data -**CVE-2013-3586
Web Viewer for Samsung DVR contains a vulnerability in its cookie-handling procedure that accepts any input as a valid session ID if placed after SessionID=
. This allows an attacker to send a specially crafted cookie containing an malicious SessionID
to the web server which bypasses authentication and can provide access to internal pages, including camera controls and account settings.
For example:
headers = { "Cookie": "=", "Accept": "text/plain"}
The CVSS score below reflects the authentication bypass attack.
A remote unauthenticated attacker may be able to retrieve the device’s administrator password, allowing them to directly access the device’s configuration web page or system password configuration files.
Apply an Update
Samsung has released updated firmware. Please see their statement on the Vendor Information page.
If applying an update is not possible, please consider the following workaround.
Restrict access to the****Samsung Web Viewer for Samsung DVR interface
Restrict access to the Samsung DVR Web Viewer interface to trusted networks. If possible, configure management and transit networks for separate VLANs, or restrict access to the device using IP access lists.
882286
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: June 05, 2013 Updated: October 03, 2013
Affected
Pursuant to the security vulnerability issue identified in CERT security notification VU#882286 Samsung Techwin has developed and released firmware to address said vulnerability by removing the cookie upon user log-out.
The affected models, firmware versions and URL links are listed below. The firmware download and installation process is contained in the product User Manual. Technical support is available at 1-877-213-1222 and at the Samsung website, <https://www.samsung-security.com/>
Model
Uploaded F/W
F/W Download URL Link (click F/W tab)
SRD-1640/840
srd-164x-t1-pkg_v1.20h_130905211340.img
SRD-440/442
srd-440x-t1-pkg_v1.20h_130905211626.img
SRD-1670/1650/870/850
srd-167x-t7-pkg_v1.30h_130906171722.img
SRD-1630/830/1610
srd-163x-t7-pkg_v1.30h_130906171722.img
SRD-470
srd-470x-t7-pkg_v1.30h_130906171722.img
SRD-1652D/852D
srd-165x-t7-pkg_v1.30h_130906171813.img
SRD-1673/873/1653
srd-1673-t1-pkg_v1.20h_130909203036.img
SRD-1654/854/473**
srd-1654-t1-pkg_v1.10h_130909203103.img
http://www.samsungsecurity.com/product/product_view.asp?idx=6922&cid=64&clvl=0#FL060000
** This models series is not released in the North America market.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Temporal | 5.4 | E:POC/RL:OF/RC:UC |
Environmental | 4.1 | CDP:N/TD:M/CR:ND/IR:ND/AR:ND |
Thanks to Andrey Bezborodov for reporting this vulnerability.
This document was written by Adam Rauf.
CVE IDs: | CVE-2013-3585, CVE-2013-3586 |
---|---|
Date Public: | 2013-08-21 Date First Published: |