Cisco Unified Videoconferencing multiple vulnerabilities - CVE-2010-3037 CVE-2010-3038

Type securityvulns
Reporter Securityvulns
Modified 2010-11-18T00:00:00


    Matta Consulting - Matta Advisory

Cisco Unified Videoconferencing multiple vulnerabilities

Advisory ID: MATTA-2010-001 CVE reference: CVE-2010-3037 CVE-2010-3038 Affected platforms: Cisco Unified Videoconferencing 3515,3522,3527,5230,3545, 5110,5115 Systems and unspecified Radvision systems Version: at least and more likely all Date: 2010-August-03 Security risk: Critical Exploitable from: Remote Vulnerability: Multiple vulnerabilities Researcher: Florent Daigniere Vendor Status: Notified, working on a patch Vulnerability Disclosure Policy: Permanent URL:

===================================================================== Description:

During an external pentest exercise for one of our clients, multiple vulnerabilities and weaknesses were found on the Cisco CUVC-5110-HD10 which allowed us to ultimately gain access to the internal network.

    • Hard-coded credentials - CVE-2010-3038

Three accounts have a login shell and a password the administrator can neither disable nor change. The affected accounts are "root", "cs" and "develop". Matta didn't spend the CPU cycles required to get those passwords but will provide the salted hashes to interested parties. The credentials can be used against both the FTP and the SSH daemon running on the device.

    • Services misconfiguration

There is an FTP daemon (vsftpd) running but no mention in the documentation of what it might be useful for. User credentials created from the web-interface allow to explore the filesystem/firmware of the device.

The file /etc/shadow has read permissions for all.

The ssh daemon (openssh) has a non-default but curious configuration. It allows port-forwarding and socks proxies to be created, X11 to be forwarded... even with the restricted shells.

The daemon binding the port of the web-interface is running as root.

    • Weak session IDs on the web interface

Session IDs are timestamps of when the user logged-in and are trivial to forge. There are numerous ways of remotely gathering the remote time and uptime, the easiest being to ask over RPC... Assuming that a user or an administrator logged into the device shortly after it was powered up, and that the network connectivity is fast, it is practical to bruteforce a valid session id.

Using this vulnerability, a non-authenticated attacker can authenticate.

    • Usage of cookies to store credentials

Credentials to access the web interface are stored in base64 format in the cookie sent by the browser. Over http in default configuration. While users are not expected to reuse their credentials, in practice they do; this is an information-disclosure bug.

    • Remote Command Injection on the web-interface - CVE-2010-3037

The script at /goform/websXMLAdminRequestCgi.cgi is vulnerable to remote command injection (post authentication). Many parameters can be abused, including but not limited to the "username" field. Obviously, as the webserver is running as root, it can lead to complete compromise of the device.

    • Weak obfuscation of credentials

The configuration file /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val contains obfuscated passwords which are trivial to reveal. This is an information-disclosure bug. Best practices recommend using PBKDF2 to store passwords.

===================================================================== Impact

If successful, a malicious third party can get full control of the device and harvest user passwords with little to no effort. The Attacker might reposition and launch an attack against other parts of the target infrastructure from there.

===================================================================== Versions affected:

Firmware version tested. All deployed versions are probably vulnerable.

===================================================================== Threat mitigation

Until a patch is issued by the vendor, Matta recommends you unplug the device from its network socket.

===================================================================== Base64 encoded decryption script for the credentials:


===================================================================== Credits

This vulnerability was discovered and researched by Florent Daigniere from Matta Consulting.

Thank you to Paul Oxman and Matthew Cerha from the Cisco PSIRT for the coordination effort.

===================================================================== History

30-07-10 initial discovery 05-08-10 our client has mitigated the risk for his infrastructure ... 23-08-10 initial attempt to contact the vendor 23-08-10 sent pre-advisory to the vendor PSIRT on using PGP id 0xCF14FEE0 23-08-10 reply from the vendor, case PSIRT-0217563645 is open ... 21-09-10 agreement on the public disclosure date ... 08-11-10 planned disclosure date (missed), CVE assignments ... 17-11-10 public disclosure

===================================================================== About Matta

Matta is a privately held company with Headquarters in London, and a European office in Amsterdam. Established in 2001, Matta operates in Europe, Asia, the Middle East and North America using a respected team of senior consultants. Matta is an accredited provider of Tigerscheme training; conducts regular research and is the developer behind the webcheck application scanner, and colossus network scanner.

===================================================================== Disclaimer and Copyright

Copyright (c) 2010 Matta Consulting Limited. All rights reserved. This advisory may be distributed as long as its distribution is free-of-charge and proper credit is given.

The information provided in this advisory is provided "as is" without warranty of any kind. Matta Consulting disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Matta Consulting or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Matta Consulting or its suppliers have been advised of the possibility of such damages.