exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ubee EVW3226 Missing Authentication / File Upload / Buffer Overflow

Ubee EVW3226 Missing Authentication / File Upload / Buffer Overflow
Posted Jun 2, 2016
Authored by Manuel Hofer | Site sec-consult.com

Ubee EVW3226 advanced wireless voice gateway suffers from missing authentication, plaintext secret storage, faux encryption, and buffer overflow vulnerabilities.

tags | advisory, overflow, vulnerability
SHA-256 | 136d8d9b98223d40e7c03d66c3a2abc0fba9f39ac558264913751097548b20bb

Ubee EVW3226 Missing Authentication / File Upload / Buffer Overflow

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20160602-0 >
=======================================================================
title: Multiple critical vulnerabilities
product: Ubee EVW3226 Advanced wireless voice gateway
vulnerable version: Firmware EVW3226_1.0.20
fixed version: -
CVE number: -
impact: critical
homepage: http://www.ubeeinteractive.com
found: 2016-01-09
by: Manuel Hofer (Office Vienna)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Bangkok - Berlin - Linz - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Ubee Interactive is on a mission. A mission that began with the development
of our industry-defining line of DOCSIS cable modems. And one that continues
with a drive toward becoming the leading business-to-business provider of
broadband connectivity products and solutions worldwide. Our current product
portfolio includes data, voice, video, mobility and portable devices."

Source: http://www.ubeeinteractive.com/products/cable/evw3226


Business recommendation:
------------------------
Network security should not depend on the security of independent devices, such
as cable modems. An attacker with root access to such a device can enable
attacks on connected networks, such as administrative networks managed by the
ISP or other cable modem users.

Vulnerabilities described in this security advisory might be exploited in
combination with other vulnerabilities not associated with this product (XSS in
web forums accessing the modem, malvertising, etc.).

It is highly recommended by SEC Consult not to use this device until a
thorough security review has been performed by security professionals and all
identified issues have been resolved.

It is assumed that further critical vulnerabilities exist within the firmware
of this device.


Vulnerability overview/description:
-----------------------------------
1) Missing authentication for configuration download
The admin interface does not explicitly require any authentication prior to
downloading a previously requested configuration backup file.

2) Plaintext storage of administrative password
The password for the user "admin" is stored in clear text. An attacker with
access to the configuration file or the device itself, can easily obtain this
password. By exploiting issue 1) the clear text admin password can be retrieved.

3) "Encrypted" configuration backup not actually encrypted
A certain built in cgi action [removed] asks the user to provide a password in
order to "encrypt your configuration's backup". A quick analysis of this
function has shown that the configuration backup does not actually get encrypted,
and only a file "pass.txt" is appended to the archive containing the password
provided by the user, in cleartext. Additionally, this promotes a false sense of
security as in this case, an attacker with access to the configuration file can
easily obtain the clear text password for the admin interface.

4) Authenticated arbitrary file upload leading to arbitrary command execution
By analyzing the configuration file format and further exploiting a known
vulnerability inside the busybox tar implementation it is possible to upload
arbitrary files to the device. This enables an attacker to execute arbitrary
system commands and gain full root access on the device.

5) Heap-based buffer overflow vulnerability in URL decoding
The function responsible for URL decoding allocates the buffer for the decoded
string based on the number of '%' characters in the request string. This leads
to a heap based buffer overflow.


Proof of concept:
-----------------
Since no public fix is available for any of the described vulnerabilities yet,
the proof of concept will not be published.


Vulnerable / tested versions:
-----------------------------
The following firmware has been tested which was the most recent version
at the time of discovery:
EVW3226_1.0.20


Vendor contact timeline:
------------------------
2016-01-13: Contacting CERT.at for security contact of
UPC Austria (Liberty Global)
2016-01-17: Contacting vendor Ubee Interactive through
'eusupport@ubeeinteractive.com' and 'eusales@ubeeinteractive.com'
requesting security contact.
2016-01-17: Disclosure of identified vulnerabilities to UPC Austria in advance.
2016-01-20: No reply from Ubee Interactive. Requesting direct contact through
UPC Austria.
2016-01-22: Received contact at Ubee Interactive. Establishing contact with
<Michael.Mao@ubeeinteractive.com> again asking for public key to
send encrypted advisory.
2016-01-23: Sending unencrypted advisory to Michael Mao and Kyle Li at Ubee.
2016-02-29: Asking Ubee for status update.
2016-02-29: Ubee states vulnerabilities 1-4 are fixed. still working on 5.
Rollout to UPC customers will need more time.
2016-02-29: SEC Consult postpones release to 2016-04-04, after discussing the
issues with UPC Austria.
2016-04-04: Asking again for status of patch deployment. No answer, rescheduling.
2016-05-13: Announcing advisory release for 2016-06-02 to UPC and asking for
status of patch deployment again.
2016-05-13: UPC Austria replies. No details, status will be provided later.
2016-05-26: Asking again for status of patch deployment, reminding about release
date.
2016-05-27: UPC Austria replies. Details on status will be provided next week.
2016-05-31: Advisory coordination with UPC.
2016-06-01: Receiving statement of UPC regarding patch status
2016-06-02: Public release of security advisory without detailed PoC as there
is no patch available.


Solution:
---------
There is no public patch available yet, it is currently in testing phase.

Here is a statement from UPC Austria concerning this issue:

"We are in close contact with the manufacturer and are working together on a
solution to the problems caused by the factory. The update will be implemented
some time in June following successful testing. In addition, UPC is continuing
with the modem swap project. Over the past 2 years, we have already provided
more than 200,000 customers in Austria and Switzerland with a new-generation
modem free of charge." (Source: UPC from 2016-06-01)


Workaround:
-----------
No workaround available.


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Manuel Hofer / 2016

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close