Exploit the possiblities

Cisco Unified Videoconferencing Command Injection / Various Issues

Cisco Unified Videoconferencing Command Injection / Various Issues
Posted Nov 18, 2010
Authored by Florent Daigniere | Site trustmatta.com

Cisco Unified Videoconferencing system versions 3515,3522,3527,5230,3545,5110 and 5115 suffer from hard-coded credential, service misconfiguration, weak session ID, cookie storing of credentials, command injection and weak obfuscation vulnerabilities.

tags | advisory, vulnerability
systems | cisco
advisories | CVE-2010-3037, CVE-2010-3038
MD5 | e1f3b894bc64923cbbd95836cd6f7f5c

Cisco Unified Videoconferencing Command Injection / Various Issues

Change Mirror Download
  Matta Consulting - Matta Advisory

Cisco Unified Videoconferencing multiple vulnerabilities

Advisory ID: MATTA-2010-001
CVE reference: CVE-2010-3037 CVE-2010-3038
Affected platforms: Cisco Unified Videoconferencing 3515,3522,3527,5230,3545,
5110,5115 Systems and unspecified Radvision systems
Version: at least and more likely all
Date: 2010-August-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities
Researcher: Florent Daigniere
Vendor Status: Notified, working on a patch
Vulnerability Disclosure Policy:
Permanent URL:


During an external pentest exercise for one of our clients, multiple
vulnerabilities and weaknesses were found on the Cisco CUVC-5110-HD10 which
allowed us to ultimately gain access to the internal network.

- - Hard-coded credentials - CVE-2010-3038

Three accounts have a login shell and a password the administrator can neither
disable nor change. The affected accounts are "root", "cs" and "develop".
Matta didn't spend the CPU cycles required to get those passwords but will
provide the salted hashes to interested parties. The credentials can be used
against both the FTP and the SSH daemon running on the device.

- - Services misconfiguration

There is an FTP daemon (vsftpd) running but no mention in the documentation
of what it might be useful for. User credentials created from the
web-interface allow to explore the filesystem/firmware of the device.

The file /etc/shadow has read permissions for all.

The ssh daemon (openssh) has a non-default but curious configuration. It
allows port-forwarding and socks proxies to be created, X11 to be
forwarded... even with the restricted shells.

The daemon binding the port of the web-interface is running as root.

- - Weak session IDs on the web interface

Session IDs are timestamps of when the user logged-in and are trivial to
forge. There are numerous ways of remotely gathering the remote time and
uptime, the easiest being to ask over RPC... Assuming that a user or an
administrator logged into the device shortly after it was powered up, and
that the network connectivity is fast, it is practical to bruteforce a
valid session id.

Using this vulnerability, a non-authenticated attacker can authenticate.

- - Usage of cookies to store credentials

Credentials to access the web interface are stored in base64 format in the
cookie sent by the browser. Over http in default configuration. While users
are not expected to reuse their credentials, in practice they do; this is
an information-disclosure bug.

- - Remote Command Injection on the web-interface - CVE-2010-3037

The script at /goform/websXMLAdminRequestCgi.cgi is vulnerable to remote
command injection (post authentication). Many parameters can be abused,
including but not limited to the "username" field. Obviously, as the
webserver is running as root, it can lead to complete compromise of the

- - Weak obfuscation of credentials

The configuration file /opt/rv/Versions/CurrentVersion/Mcu/Config/Mcu.val
contains obfuscated passwords which are trivial to reveal. This is an
information-disclosure bug. Best practices recommend using PBKDF2 to store


If successful, a malicious third party can get full control of the device and
harvest user passwords with little to no effort. The Attacker might
reposition and launch an attack against other parts of the target
infrastructure from there.

Versions affected:

Firmware version tested. All deployed versions are probably

Threat mitigation

Until a patch is issued by the vendor, Matta recommends you unplug the
device from its network socket.

Base64 encoded decryption script for the credentials:



This vulnerability was discovered and researched by Florent Daigniere from
Matta Consulting.

Thank you to Paul Oxman and Matthew Cerha from the Cisco PSIRT for the
coordination effort.


30-07-10 initial discovery
05-08-10 our client has mitigated the risk for his infrastructure
23-08-10 initial attempt to contact the vendor
23-08-10 sent pre-advisory to the vendor
PSIRT on psirt@cisco.com using PGP id 0xCF14FEE0
23-08-10 reply from the vendor, case PSIRT-0217563645 is open
21-09-10 agreement on the public disclosure date
08-11-10 planned disclosure date (missed), CVE assignments
17-11-10 public disclosure

About Matta

Matta is a privately held company with Headquarters in London, and a European
office in Amsterdam. Established in 2001, Matta operates in Europe, Asia,
the Middle East and North America using a respected team of senior
consultants. Matta is an accredited provider of Tigerscheme training;
conducts regular research and is the developer behind the webcheck
application scanner, and colossus network scanner.


Disclaimer and Copyright

Copyright (c) 2010 Matta Consulting Limited. All rights reserved.
This advisory may be distributed as long as its distribution is
free-of-charge and proper credit is given.

The information provided in this advisory is provided "as is" without
warranty of any kind. Matta Consulting disclaims all warranties, either
express or implied, including the warranties of merchantability and fitness
for a particular purpose. In no event shall Matta Consulting or its
suppliers be liable for any damages whatsoever including direct, indirect,
incidental, consequential, loss of business profits or special damages,
even if Matta Consulting or its suppliers have been advised of the
possibility of such damages.


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    7 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By