SEC Consult Vulnerability Lab Security Advisory < 20190904-0 >
=======================================================================
              title: Multiple vulnerabilities
            product: Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P,
                     Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160,
                     Cisco 160W
 vulnerable version: Cisco RV34X - 1.0.02.16, Cisco RV16X/26X - 1.0.00.15
      fixed version: see "Solution"
         CVE number: -
             impact: High
           homepage: https://www.cisco.com/
              found: 2019-05-15
                 by: T. Weber, S. Viehböck (Office Vienna)
                     IoT Inspector
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Securely connecting your small business to the outside world is as important
as connecting your internal network devices to one another. Cisco Small
Business RV Series Routers offer virtual private networking (VPN) technology
so your remote workers can connect to your network through a secure Internet
pathway."

Source: https://www.cisco.com/c/en/us/products/routers/small-business-rv-series-routers/index.html


Business recommendation:
------------------------
We want to thank Cisco for the very quick and professional response and great
coordination. Customers are urged to update the firmware of their devices.


Vulnerability overview/description:
-----------------------------------
1) Hardcoded Credentials
The device contains hardcoded users and passwords which can be used to login
via SSH on an emulated device at least.

During the communication with Cisco it turned out that:
"Accounts like the 'debug-admin' and 'root' can not be accessed
from console port, CLI or webui".
Therefore, these accounts had no real functionality and cannot be used for
malicious actions.

2) Known GNU glibc Vulnerabilities
The used GNU glibc in version 2.19 is outdated and contains multiple known
vulnerabilities. The outdated version was found by IoT Inspector. One of
the discovered vulnerabilities (CVE-2015-7547, "getaddrinfo() buffer overflow")
was verified by using the MEDUSA scalable firmware runtime.

3) Known BusyBox Vulnerabilities
The used BusyBox toolkit in version 1.23.2 is outdated and contains multiple
known vulnerabilities. The outdated version was found by IoT Inspector.
One of the discovered vulnerabilities (CVE-2017-16544) was verified by using
the MEDUSA scaleable firmware runtime.


4) Multiple Vulnerabilities - IoT Inspector Report
Further information can be found in IoT Inspector report:
https://r.sec-consult.com/ciscoiot


Proof of concept:
-----------------
1) Hardcoded Credentials
The following hardcoded hashes were found in the 'shadow' file of the firmware:
root:$1$hPNSjUZA$7eKqEpqVYltt9xJ6f0OGf0:15533:0:99999:7:::
debug-admin:$1$.AAm0iJ4$na9wZwly9pSrdS8MhcGKw/:15541:0:99999:7:::
[...]

The undocumented user 'debug-admin' is also contained in this file.

Starting the dropbear daemon as background process on emulated firmware:
-------------------------------------------------------------------------------
# dropbear -E
# [1109] <timestamp> Running in background
#
# [1112] <timestamp> Child connection from <IP>:52718
[1112] <timestamp> /var must be owned by user or root, and not writable by others
[1112] <timestamp> Password auth succeeded for 'debug-admin' from <IP>:52718
-------------------------------------------------------------------------------

Log on via another host connected to the same network. For this PoC the
password of the debug-admin was changed in the 'shadow' file.
-------------------------------------------------------------------------------
[root@localhost medusa]# ssh debug-admin@<IP> /bin/ash -i
debug-admin@<IP>'s password:
/bin/ash: can't access tty; job control turned off


BusyBox v1.23.2 (2018-11-21 18:22:56 IST) built-in shell (ash)

/tmp $
-------------------------------------------------------------------------------

The 'debug-admin' user has the same privileges like 'root'. This can be
determined from the corresponding sudoers file in the firmware:
[...]
## User privilege specification
##
root ALL=(ALL) ALL
debug-admin ALL=(ALL) ALL

## Uncomment to allow members of group wheel to execute any command
# %wheel ALL=(ALL) ALL
[...]

During the communication with Cisco it turned out that:
"Accounts like the 'debug-admin' and 'root' can not be accessed
from console port, CLI or webui".
Therefore, these accounts had no real functionality and cannot be used for
malicious actions.

2) Known GNU glibc Vulnerabilities
GNU glibc version 2.19 contains multiple CVEs like:
CVE-2014-4043, CVE-2014-9402, CVE-2014-9761, CVE-2014-9984, CVE-2015-1472,
CVE-2015-5277, CVE-2015-8778, CVE-2015-8779, CVE-2017-1000366 and more.

The getaddrinfo() buffer overflow vulnerability was checked with the help of
the exploit code from https://github.com/fjserna/CVE-2015-7547. It was compiled
and executed on the emulated device to test the system.

# python cve-2015-7547-poc.py &
[1] 961
# chroot /medusa_rootfs/ bin/ash


BusyBox v1.23.2 (2018-11-21 18:22:56 IST) built-in shell (ash)

# gdb cve-2015-7547_glibc_getaddrinfo
[...]
[UDP] Total Data len recv 36
[UDP] Total Data len recv 36
Connected with 127.0.0.1:41782
[TCP] Total Data len recv 76
[TCP] Request1 len recv 36
[TCP] Request2 len recv 36
Cannot access memory at address 0x4

Program received signal SIGSEGV, Segmentation fault.
0x76f1fd58 in ?? () from /lib/libc.so.6
(gdb)

References:
https://security.googleblog.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://github.com/fjserna/CVE-2015-7547


3) Known BusyBox Vulnerabilities
BusyBox version 1.23.2 contains multiple CVEs like:
CVE-2016-2148, CVE-2016-6301, CVE-2015-9261, CVE-2016-2147, CVE-2018-20679,
CVE-2017-16544 and CVE-2019-5747.
The BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verified on
an emulated device:

A file with the name "\ectest\n\e]55;test.txt\a" was created to trigger the
vulnerability.
-------------------------------------------------------------------------------
# ls "pressing <TAB>"
test
]55;test.txt
#
-------------------------------------------------------------------------------

4) Multiple Vulnerabilities - IoT Inspector Report
Further information can be found in IoT Inspector report:
https://r.sec-consult.com/ciscoiot

The summary is below:
IoT Inspector Vulnerability #1 BusyBox CVE entries
Outdated BusyBox version is affected by 7 published CVEs.

IoT Inspector Vulnerability #2 curl CVE entries
Outdated curl version is affected by 35 published CVEs.

IoT Inspector Vulnerability #3 GNU glibc CVE entries
Outdated GNU glibc version is affected by 44 published CVEs.

IoT Inspector Vulnerability #4 GNU glibc getaddrinfo() buffer overflow
Outdated GNU glibc version is affected by CVE-2015-7547.

IoT Inspector Vulnerability #5 Hardcoded password hashes
Firmware contains multiple hardcoded credentials.

IoT Inspector Vulnerability #6 Linux Kernel CVE entries
Outdated Linux Kernel version affected by 512 published CVEs.

IoT Inspector Vulnerability #7 MiniUPnPd CVE entries
Outdated MiniUPnPd version affected by 2 published CVEs.

IoT Inspector Vulnerability #8 Dnsmasq CVE entries
Outdated MiniUPnPd version affected by 1 published CVE.

IoT Inspector Vulnerability #9 Linux Kernel Privilege Escalation “pp_key”
Outdated Linux Kernel version is affected by CVE-2015-7547.

IoT Inspector Vulnerability #10 OpenSSL CVE entries
Outdated OpenSSL  version affected by 6 published CVEs.


Vulnerable / tested versions:
-----------------------------
The following firmware versions have been tested with IoT Inspector and
firmware emulation techniques:
Cisco RV340  / 1.0.02.16
Cisco RV340W / 1.0.02.16
Cisco RV345  / 1.0.02.16
Cisco RV345P / 1.0.02.16
The following firmware versions have been tested with IoT Inspector only:
Cisco RV260  / 1.0.00.15
Cisco RV260P / 1.0.00.15
Cisco RV260W / 1.0.00.15
Cisco RV160  / 1.0.00.15
Cisco RV160P / 1.0.00.15

The firmware was obtained from the vendor website:
https://software.cisco.com/download/home/286287791/type/282465789/release/1.0.02.16
https://software.cisco.com/download/home/286316464/type/282465789/release/1.0.00.15


Vendor contact timeline:
------------------------
2019-05-15: Contacting vendor through psirt@cisco.com.
2019-05-16: Vendor confirmed the receipt.
2019-05-2019-08: Periodic updates about the investigation from the vendor.
            Clarification which of the reported issues will be fixed.
2019-08-20: The vendor proposed the next possible publication date for the
            advisory for 2019-09-04. The vendor added the RV160 and RV260
            router series to be vulnerable to the same issues too.
2019-09-04: Coordinated advisory release.


Solution:
---------
Upgrade to the newest available firmware version.

Additionally, the vendor provides the following security notice:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-sb-vpnrouter


Workaround:
-----------
None.


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF T. Weber / @2019