AOH :: HP Unsorted T :: BX6115.HTM

TANDBERG VCS Arbitrary File Retrieval



CVE-2009-4511: TANDBERG VCS Arbitrary File Retrieval
CVE-2009-4511: TANDBERG VCS Arbitrary File Retrieval



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



                   Virtual Security Research, LLC.
http://www.vsecurity.com/ 
                         Security Advisory


- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Advisory Name: TANDBERG Video Communication Server Arbitrary File Retrieval
 Release Date: 2010-04-09
  Application: Video Communication Server (VCS)
     Versions: x4.3.0, x4.2.1, and possibly earlier
     Severity: Medium
Discovered by: Jon Hart
  Advisory by: Timothy D. Morgan 
Vendor Status: Firmware update released [2]
CVE Candidate: CVE-2009-4511
Reference: http://www.vsecurity.com/resources/advisory/20100409-3/ 

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


Product Description
- -------------------
- From [1]:

 "The Video Communication Server (VCS) is an integral part of the TANDBERG 
  Total Solution and is the center of the video communications network, 
  connecting the benefits of video conferencing and telepresence to other 
  communications environments including unified communications and IP Telephony
  networks."


Vulnerability Overview
- ----------------------
On December 3rd, VSR identified a directory traversal and file retrieval
vulnerability in the TANDBERG's Video Communication Server.  This issue would
allow an authenticated attacker (who has access as an administrator or less
privileged user on the web administration interface) to retrieve files from the
filesystem which are readable by the "nobody" system user.


Product Background
- ------------------
The TANDBERG Video Communication Server is a Linux-based appliance which
supports the interoperation of a plethora of video and voice communications
devices.  The VCS provides a web-based management interface implemented in PHP
which allows administrators to perform a wide variety of actions, including
configuration of the device, management of user accounts, firmware updates, 
along with number of other items.


Vulnerability Details
- ---------------------
The TANDBERG VCS web management interface provides two nearly identical scripts
at URLs:
  https://vulnerable.example.com/helppage.php
  https://vulnerable.example.com/user/helppage.php

These help pages accept a "file" parameter in the URL which can be used to
retrieve nearly arbitrary files from the filesystem.  The relevant source code
for these pages is as follows:

// The following is Copyright (C) 2009 TANDBERG //
...
// Grab the content before we write anything: we'll need it for the title tag in the 
// Dig out the page title, from the  tag, 
// then remove any surround in the page as we add our own... 
$filename = $this->helpPagePath . $_GET['page'] . $this->helpPageSuffix;
       
if (! file_exists($filename)) {
  $helpHTML = "There is no help available for the ". $_GET['page'] . " page<br/>";
  $pageTitle = $_GET['page'];
}else{
  $helpHTML = file_get_contents($filename);

...

  echo "\n<!-- ********** -->\n";
  echo $helpHTML;
  echo "<!-- ********** -->\n";
...
// end of excerpt //


Here, the final path string ($filename) loaded and displayed to the user is
prepended with a directory and appended with a file extension.  Using simple
directory traversal techniques ("../") it is possible to traverse to any
directory on the filesystem.  Using a trailing NUL byte encoded in the URL (%00)
it is also possible to truncate the file path to eliminate the file extension.

For instance, the following URL retrieves the /etc/passwd file:

  https://vulnerable.example.com/helppage.php?page=../../../../etc/passwd%00


During testing, it was found that the x4.2.1 firmware runs the web server as the
"nobody" user, which somewhat limits the amount of sensitive information that
may be obtained.  However, since shadowed passwords were not configured, it was
possible to retrieve all local system users' password hashes from /etc/passwd. 
Additional password hashes are available in /tandberg/persistent/etc/digest.


Versions Affected
- -----------------
VSR has successfully exploited this issue in firmware version x4.2.1.  Based on
preliminary source code analysis[2], versions x4.3.0 and x5.0 also appear to be
vulnerable.  Earlier versions have not been tested.


Vendor Response
- ---------------
The following timeline details TANDBERG's response to the reported issue:

2009-12-09    Preliminary notice to TANDBERG. TANDBERG responded immediately.

2009-12-22    VSR provided TANDBERG a draft advisory.

2009-12-28    TANDBERG provided VSR with a beta version of the x5.0 firmware,
              but this did not appear to correct the issue (based on PHP code
              analysis alone).

2010-01-22    TANDBERG provided VSR with a beta version of the x5.1 firmware 
              for testing which appeared to correct the vulnerability.

2010-03-26    TANDBERG provided VSR with a release candidate firmware for 
              version x5.1.1.

2010-04-07    TANDBERG VCS firmware version x5.1.1 released [2].

2010-04-09    VSR advisory released.


Recommendation
- --------------
Upgrade to version x5.1.1 to correct this issue.  Temporary mitigation may be 
achieved by disabling access for potentially less trusted, non-adminstrative
users.


Common Vulnerabilities and Exposures (CVE) Information
- ------------------------------------------------------
The Common Vulnerabilities and Exposures (CVE) project has assigned
the number CVE-2009-4511 to this issue.  This is a candidates for
inclusion in the CVE list <a href="http://cve.mitre.org">(http://cve.mitre.org),</a> which standardizes 
names for security problems.


Acknowledgements
- ----------------
Thanks to TANDBERG for the quick initial response and cooperation.


- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

References:

1. TANDBERG - Video Communication Server
<a href="http://www.tandberg.com/video-conferencing-network-infrastructure/video-communication-server.jsp">http://www.tandberg.com/video-conferencing-network-infrastructure/video-communication-server.jsp</a> 

2. TANDBERG VCS Firmware Downloads
<a href="http://ftp.tandberg.com/pub/software/vcs/">http://ftp.tandberg.com/pub/software/vcs/</a> 

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
   Copyright 2009,2010 Virtual Security Research, LLC.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFLv/bkQ1RSUNR+T+gRAuThAKCTilCnuTbLWgK1U/ByAPeY9VWQGwCfZsOO
+uOm1DQpX16KuhclPLBcdfg=TQ5s
-----END PGP SIGNATURE-----

</b></font></pre></tt></body></html>


<!-- google_ad_section_end -->
<p><center>
<script type="text/javascript"><!--
google_ad_client = "pub-7461597152411296";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_type = "text";
//2007-07-08: TUCoPS
google_ad_channel = "2214400198";
google_color_border = "C3D9FF";
google_color_bg = "F8FFFF";
google_color_link = "003366";
google_color_text = "000000";
google_color_url = "009988";
google_ui_features = "rc:6";
//-->
</script>
<script type="text/javascript"
  src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>

<p></center>
<center><a href="/firefox.htm">The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).</a></center>
<font size=1><center>Site design & layout copyright © 1986-2014 AOH</font>
<br><font size="1"><b>We do not send spam.</b>  If you have received spam bearing an artofhacking.com email address, please forward it with full headers to <a href="mailto:abuse@artofhacking.com">abuse@artofhacking.com</a></font>.</center>
<br><center><IMG SRC="http://artofhacking.com/cgi-bin/sc/sc.cgi?acct=tucops&font=payphone-med"></center>
</body>
</html>