Exploit-DB #17244
Description: ZyWALL USG Appliance - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2011-05-04
Author: RedTeam Pentesting

Exploit:
Advisory: Authentication Bypass in Configuration Import and Export of
          ZyXEL ZyWALL USG Appliances

Unauthenticated users with access to the management web interface of
certain ZyXEL ZyWALL USG appliances can download and upload
configuration files, that are applied automatically.


Details
=======

Product: ZyXEL USG (Unified Security Gateway) appliances
         ZyWALL USG-20
         ZyWALL USG-20W
         ZyWALL USG-50
         ZyWALL USG-100
         ZyWALL USG-200
         ZyWALL USG-300
         ZyWALL USG-1000
         ZyWALL USG-1050
         ZyWALL USG-2000
         Possibly other ZLD-based products
Affected Versions: Firmware Releases before April 25, 2011
Fixed Versions: Firmware Releases from or after April 25, 2011
Vulnerability Type: Authentication Bypass
Security Risk: high
Vendor URL: http://www.zyxel.com/
Vendor Status: fixed version released
Advisory URL: http://www.redteam-pentesting.de/advisories/rt-sa-2011-003
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

``The ZyWALL USG (Unified Security Gateway) Series is the "third
generation" ZyWALL featuring an all-new platform. It provides greater
performance protection, as well as a deep packet inspection security
solution for small businesses to enterprises alike. It embodies a
Stateful Packet Inspection (SPI) firewall, Anti-Virus, Intrusion
Detection and Prevention (IDP), Content Filtering, Anti-Spam, and VPN
(IPSec/SSL/L2TP) in one box. This multilayered security safeguards your
organization's customer and company records, intellectual property, and
critical resources from external and internal threats.''

(From the vendor's homepage)


More Details
============

During a penetration test, a ZyXEL ZyWALL USG appliance was found and
tested for security vulnerabilities.  The following sections first
describe, how the appliance's filesystem can be extracted from the
encrypted firmware upgrade zip files.  Afterwards it is shown, how
arbitrary configuration files can be up- and downloaded from the
appliance.  This way, a custom user account with a chosen password can
be added to the running appliance without the need of a reboot.


Decrypting the ZyWALL Firmware Upgrade Files
--------------------------------------------

Firmware upgrade files for ZyXEL ZyWALL USG appliances consist of a
regularly compressed zip file, which contains, among others, two
encrypted zip files with the main firmware.  For example, the current
firmware version 2.21(BQD.2) for the ZyWALL USG 20 ("ZyWALL USG
20_2.21(BDQ.2)C0.zip") contains the following files:

  -rw-r--r-- 1 user user 43116374 Sep 30  2010 221BDQ2C0.bin
  -rw-r--r-- 1 user user     7354 Sep 30  2010 221BDQ2C0.conf
  -rw-r--r-- 1 user user    28395 Sep 30  2010 221BDQ2C0.db
  -rw-r--r-- 1 user user   703402 Oct 12 17:48 221BDQ2C0.pdf
  -rw-r--r-- 1 user user  3441664 Sep 30  2010 221BDQ2C0.ri
  -rw-r--r-- 1 user user      231 Sep 30  2010 firmware.xml

The files 221BDQ2C0.bin and 221BDQ2C0.db are encrypted zip files that
require a password for decompression.  Listing the contents is
possible:

  $ unzip -l 221BDQ2C0.bin
  Archive:  221BDQ2C0.bin
    Length      Date    Time    Name
  ---------  ---------- -----   ----
   40075264  2010-09-15 06:32   compress.img
          0  2010-09-30 04:48   db/
          0  2010-09-30 04:48   db/etc/
          0  2010-09-30 04:48   db/etc/zyxel/
          0  2010-09-30 04:48   db/etc/zyxel/ftp/
          0  2010-09-30 04:48   db/etc/zyxel/ftp/conf/
         20  2010-09-14 14:46   db/etc/zyxel/ftp/conf/htm-default.conf
       7354  2010-09-14 14:46   db/etc/zyxel/ftp/conf/system-default.conf
          0  2010-09-30 04:48   etc_writable/
          0  2010-09-30 04:48   etc_writable/budget/
          0  2010-09-14 15:08   etc_writable/budget/budget.conf
          0  2010-09-15 06:28   etc_writable/firmware-upgraded
         81  2010-09-14 15:09   etc_writable/myzyxel_info.conf
        243  2010-09-14 15:03   etc_writable/tr069ta.conf
          0  2010-09-30 04:48   etc_writable/zyxel/
          0  2010-09-30 04:48   etc_writable/zyxel/conf/
        996  2010-09-15 06:28   etc_writable/zyxel/conf/__eps_checking_default.xml
      42697  2010-09-14 14:46   etc_writable/zyxel/conf/__system_default.xml
         95  2010-09-30 04:48   filechecksum
       1023  2010-09-30 04:48   filelist
        336  2010-09-30 04:48   fwversion
         50  2010-09-15 06:34   kernelchecksum
    3441664  2010-09-30 04:48   kernelusg20.bin
          0  2010-09-14 14:46   wtp_image/
  ---------                     -------
   43569823                     24 files

  $ unzip -l 221BDQ2C0.db
  Archive:  221BDQ2C0.db
    Length      Date    Time    Name
  ---------  ---------- -----   ----
          0  2009-07-29 04:44   db_remove_lst
          0  2010-09-15 06:28   etc/
          0  2010-09-15 06:35   etc/idp/
         39  2010-09-14 16:08   etc/idp/all.conf
         25  2010-09-14 16:08   etc/idp/attributes.txt
        639  2010-09-14 16:08   etc/idp/attributes_self.txt
        277  2010-09-14 16:08   etc/idp/device.conf
         39  2010-09-14 16:08   etc/idp/dmz.conf
         39  2010-09-14 16:08   etc/idp/lan.conf
         39  2010-09-14 16:08   etc/idp/none.conf
      60581  2010-09-14 16:08   etc/idp/self.ref
       5190  2010-09-14 16:08   etc/idp/self.rules
          0  2010-09-14 16:08   etc/idp/update.ref
          0  2010-09-14 16:08   etc/idp/update.rules
         39  2010-09-14 16:08   etc/idp/wan.conf
     445075  2010-09-14 16:08   etc/idp/zyxel.ref
        327  2010-09-14 16:08   etc/idp/zyxel.rules
          0  2010-09-14 16:05   etc/zyxel/
          0  2010-09-15 06:35   etc/zyxel/ftp/
          0  2010-09-15 06:35   etc/zyxel/ftp/.dha/
          0  2010-09-15 06:35   etc/zyxel/ftp/.dha/dha_idp/
          0