Sign-up

ID

VAR-201310-0207


CVE

CVE-2013-3689


TITLE

Brickcom Multiple IP Cameras Information Disclosure Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2013-07706 // CNNVD: CNNVD-201306-264

DESCRIPTION

Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.0.6.16C1 and earlier, do not properly restrict access to configfile.dump, which allow remote attackers to obtain sensitive information (user names, passwords, and configurations) via a get action. Brickcom IP Cameras are IP camera devices. Multiple Brickcom IP Cameras devices have security vulnerabilities that allow remote attackers to exploit vulnerabilities without having to verify direct commit requests for profile information. Brickcom multiple IP cameras including FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, and OSD-040E are prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Brickcom FB-100Ap and so on are network camera products of Brickcom. The vulnerability is caused by the program not properly restricting access to the configfile.dump file. The following network camera models are affected: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E. ============================================================================ BRICKCOM ==================================================================== ============================================================================ 1.Advisory Information Title: Brickcom 100ap Series Vulnerabilities Date Published: 12/06/2013 Date of last updated: 12/06/2013 2.Vulnerability Description Multiples vulnerabilities have been found in this device. -CVE-2013-3689. Authentication Bypass Issues(CWE-592) and Clear Text Storage of Sensitive Information(CWE-312) -CVE-2013-3690. Cross Site Request Forgery(CWE-352), Permissions, Privileges, and Access Control(CWE-264) and Execution with Unnecessary Privileges(CWE-250) 3.Affected Products The following products are affected by these vulnerabilities: FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E It\x92s possible others models are affected but they were not checked. -CVE-2013-3689. We have detected the following vulnerable firmwares: firmwareVersion=v3.0.6.7, v3.0.6.12, v3.0.6.16C1 In the next firmwares, you need to be log-in as administrator to download this file, but the information is in plain text yet: firmwareVersion=v3.1.0.8,v3.1.0.4 -CVE-2013-3690. All firmware checked. 4.PoC 4.1.Authentication Bypass & Clear Text Storage of Sensitive Information CVE-2013-3689, These allows you to download the all the configuration device file writing the next URL (all data shown will be in plain text). It\x92s not necessary any authentication. _____________________________________________________________________________ http://xx.xx.xx.xx/configfile.dump?action=get _____________________________________________________________________________ The most interesting parameters could be: UserSetSetting.userList.users[n\xba].password= *** UserSetSetting.userList.users[n\xba].name= *** 4.2.Cross Site Request Forgerty (CSRF) + Privilege Escalation CVE-2013-3690, CSRF is possible via POST method. Also is possible a privilege escalation from a viewer user to an administrator user. A malicious user can try targeted attacks by sending a special CSRF vector. This allows you to manipulate web interface parameters. The following request can exploit this vulnerability _____________________________________________________________________________ <html> <body> <form name="gobap" action="http://xx.xx.xx.xx/cgi-bin/users.cgi" method="POST"> <input type="hidden" name="action" value="add"> <input type="hidden" name="index" value="0"> <input type="hidden" name="username" value="test2"> <input type="hidden" name="password" value="test2"> <input type="hidden" name="privilege" value="1"> <script>document.gobap.submit();</script> </form> </body> </html> _____________________________________________________________________________ 5.Credits -CVE-2013-3689 was discovered by Eliezer Varad\xe9 Lopez, Javier Repiso S\xe1nchez and Jon\xe1s Ropero Castillo. -CVE-2013-3690 was discovered by Jon\xe1s Ropero Castillo. 6.Report Timeline -2013-05-31: Students team notifies the Brickcom Customer Support of the vulnerabilities. -2013-05-31: Brickcom answers saying this in accordance with some of the vulnerabilities, but there are some that they think is not correct. (CVE-2013-3689, Authentication bypass and plain text information: After talk with vendor, it\x92s looks that after firmware 3.1.x.x, this bug is fixed but still the information is shown in plain text, so they should fix this second one) -2013-06-03: Students check and communicate Brickcom the detail products and firmwares affected by vulnerabilities. -2013-06-04: The vendor is agree with everything stated and reports that will fix it as soon as possible

Trust: 2.61

sources: NVD: CVE-2013-3689 // JVNDB: JVNDB-2013-004513 // CNVD: CNVD-2013-07706 // BID: 60525 // VULHUB: VHN-63691 // PACKETSTORM: 122003

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-07706

AFFECTED PRODUCTS

vendor:brickcommodel:osd-040escope: - version: -

Trust: 1.4

vendor:brickcommodel:ob-100aescope: - version: -

Trust: 1.4

vendor:brickcommodel:wfb-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:md-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:wcb-100apscope: - version: -

Trust: 1.4

vendor:brickcommodel:fb-100apscope: - version: -

Trust: 1.4

vendor:brickommodel:md-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:wfb-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:100ap devicescope:lteversion:3.0.6.16c1

Trust: 1.0

vendor:brickommodel:osd-040escope:eqversion: -

Trust: 1.0

vendor:brickommodel:wcb-100apscope:eqversion: -

Trust: 1.0

vendor:brickommodel:ob-100aescope:eqversion: -

Trust: 1.0

vendor:brickommodel:fb-100apscope:eqversion: -

Trust: 1.0

vendor:brickcommodel:100-ap seriesscope:lteversion:3.0.6.16c1

Trust: 0.8

vendor:brickommodel:100ap devicescope:eqversion:3.0.6.16c1

Trust: 0.6

sources: CNVD: CNVD-2013-07706 // JVNDB: JVNDB-2013-004513 // CNNVD: CNNVD-201306-264 // NVD: CVE-2013-3689

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-3689
value: HIGH

Trust: 1.0

NVD: CVE-2013-3689
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-07706
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201306-264
value: HIGH

Trust: 0.6

VULHUB: VHN-63691
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-3689
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-07706
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-63691
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2013-07706 // VULHUB: VHN-63691 // JVNDB: JVNDB-2013-004513 // CNNVD: CNNVD-201306-264 // NVD: CVE-2013-3689

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-63691 // JVNDB: JVNDB-2013-004513 // NVD: CVE-2013-3689

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201306-264

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201306-264

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-004513

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-63691

PATCH
title:Top Pageurl:http://www.brickcom.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-004513

EXTERNAL IDS
db:NVDid:CVE-2013-3689
Trust: 3.5
db:BIDid:60525
Trust: 1.6
db:JVNDBid:JVNDB-2013-004513
Trust: 0.8
db:CNNVDid:CNNVD-201306-264
Trust: 0.7
db:CNVDid:CNVD-2013-07706
Trust: 0.6
db:FULLDISCid:20130612 SECURITY ANALYSIS OF IP VIDEO SURVEILLANCE CAMERAS
Trust: 0.6
db:PACKETSTORMid:122003
Trust: 0.2
db:VULHUBid:VHN-63691
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07706 // 
            
            
            
            VULHUB: VHN-63691 // 
            
            
            
            BID: 60525 // 
            
            
            
            JVNDB: JVNDB-2013-004513 // 
            
            
            
            PACKETSTORM: 122003 // 
            
            
            
            CNNVD: CNNVD-201306-264 // 
            
            
            
            NVD: CVE-2013-3689

REFERENCES
url:http://seclists.org/fulldisclosure/2013/jun/84
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3689
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3689
Trust: 0.8
url:http://www.securityfocus.com/bid/60525
Trust: 0.6
url:http://xx.xx.xx.xx/configfile.dump?action=get
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-3690
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-3689
Trust: 0.1
url:http://xx.xx.xx.xx/cgi-bin/users.cgi"
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07706 // 
            
            
            
            VULHUB: VHN-63691 // 
            
            
            
            JVNDB: JVNDB-2013-004513 // 
            
            
            
            PACKETSTORM: 122003 // 
            
            
            
            CNNVD: CNNVD-201306-264 // 
            
            
            
            NVD: CVE-2013-3689

CREDITS
Eliezer Varad Lopez, Javier Repiso Snchez and Jons Ropero Castillo.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201306-264

SOURCES
db:CNVDid:CNVD-2013-07706
db:VULHUBid:VHN-63691
db:BIDid:60525
db:JVNDBid:JVNDB-2013-004513
db:PACKETSTORMid:122003
db:CNNVDid:CNNVD-201306-264
db:NVDid:CVE-2013-3689

LAST UPDATE DATE
2024-11-23T21:16:43.910000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-07706date:2013-08-28T00:00:00
db:VULHUBid:VHN-63691date:2013-10-07T00:00:00
db:BIDid:60525date:2013-06-13T00:00:00
db:JVNDBid:JVNDB-2013-004513date:2013-10-08T00:00:00
db:CNNVDid:CNNVD-201306-264date:2013-10-08T00:00:00
db:NVDid:CVE-2013-3689date:2024-11-21T01:54:07.927

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-07706date:2013-06-20T00:00:00
db:VULHUBid:VHN-63691date:2013-10-04T00:00:00
db:BIDid:60525date:2013-06-13T00:00:00
db:JVNDBid:JVNDB-2013-004513date:2013-10-08T00:00:00
db:PACKETSTORMid:122003date:2013-06-13T06:08:04
db:CNNVDid:CNNVD-201306-264date:2013-06-18T00:00:00
db:NVDid:CVE-2013-3689date:2013-10-04T23:55:03.970