Name: [CVE-2012-5858] [CVE-2012-5859] DoS/Authorization Bypass - Kies Air
Package: com.samsung.swift.app.kiesair
Affected versions: 2.1.207051, 2.1.210161
Testing Device: Samsung S3 (AT&T) - SAMSUNG-SGH-I747
Android Version: 4.0.4/ Build Number: IMM76D.I747UCALH9
Vendor homepage: http://www.samsung.com/us/kiesair
Researcher: Claudio J. Lacayo


APPLICATION OVERVIEW
======================
Kies Air is a application that enables you to easily manage contents saved on your device via PC internet or mobile browser using Wi-Fi technology. Without having to connect any cables, within a browser you can use diverse function such as multimedia transfer, music listening, PIMS management, text message, file search, and so on.

VULNERABILITY SUMMARY
=======================
The default application behaviour of the Kies Air application was analyzed uncovering a local authorization bypass attack that allows a malicious attacker to obtain the full contents of the phone. Kies Air uses IP based authorization to allow access to the owners device via a web browser. The application has support for HTTPS but does not use it. Once a request is granted to an IP, an attacker can spoof the IP, de-authenticate the authorized client and assume the IP to retrieve content without alarming the user. It was also found that a specially crafted request can cause the application to crash at will. This DoS attack only requires the application to be running.

DETAILS
=======
Authorization Bypass:
A series of HTTP requests are made when the client connects to the Kies Air web server. The server responds with two 301 responses. The first 301 Moved Permanently response points to http://{TARGET_IP}:8080/www/index.html followed by another 301 pointing to a new URI location at: http://{TARGET_IP}:8080/www/index.gz.html - if the user is allowed access, the server responds with 200 OK otherwise a 401 Unauthorized response is returned.
Once the Kies Air web server is identified a de-authentication request can be sent to remove the authorized user on the network and obtain the authorized IP. Requesting access to Kies Air does not require the client to re-authenticate nor alert the mobile user that another connection attempt is being made.

Denial of Service:
Send GET request http://{TARGET_IP}:8080/www/apps/KiesAir/jws/ssd.php?E&

ADVISORY TIMELINE
=================
10/16/2012 - Authorization bypass found and confirmed 
10/20/2012 - DoS found and confirmed
11/5/2012 - Vendor notified via email to Kies Air Support team.
11/6/2012 - Kies Air support team responds, requests vulnerability details to forward to Kies Air Development team. Whitepaper and code provided
11/10/2012 - Member from Mobile Security Team requests vulnerability disclosure extension. Due to severity and attack scope request denied and issue details published.
11/11/2012 - Advisory released.

CVSS 2.0 Base Metrics
==================
Reference Base Vector Base Score
CVSS Base Score
6.1
Impact Subscore
8.5
Exploitability Subscore
3.9
CVSS Temporal Score
5.3
CVSS Environmental Score
4.2
Modified Impact Subscore
6.7
Overall CVSS Score
4.2

RESOLUTION
===========
Upgrade the latest version of Kies Air to 2.2.211081 released November 8th, 2012.

REFERENCES
============
Whitepaper: http://dl.dropbox.com/u/7779799/SamsungKiesAirAuthorizationBypassandDoS.pdf
PoC: https://github.com/cjlacayo/bash/blob/master/KiesAir/kiesauth.sh