bugtraq - Re: Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and NETGEAR Surveillance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <faee8b34-15a3-490e-e8fe-3bb5f5fa73ad@gmail.com>
Date: Thu, 4 Aug 2016 17:47:42 +0100
From: Pedro Ribeiro <pedrib@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
  bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Multiple remote vulnerabilities (RCE, bof) in Nuuo NVR and
 NETGEAR Surveillance

On 04/08/16 17:46, Pedro Ribeiro wrote:
> tl;dr
> 
> Lots of RCE, hardcoded credentials, stack buffer overflow and
> information disclosure in the Nuuo NVRmini and other network video
> recorders of the same vendor.
> These vulnerabilities also affect the NETGEAR Surveillance app (which
> can be installed on the NETGEAR ReadyNAS).
> 
> See the full advisory including PoC and exploits below, or at my github
> (https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-nvr-vulns.txt).
> 
> Metasploit modules have been submitted for vulns #1, #2 and #3:
> https://github.com/rapid7/metasploit-framework/pull/7180
> https://github.com/rapid7/metasploit-framework/pull/7181
> https://github.com/rapid7/metasploit-framework/pull/7182
> 
> Thanks to CERT/CC for helping me disclose this vulnerabilities - see
> https://www.kb.cert.org/vuls/id/856152 for their advisory.
> 
> Regards,
> Pedro
> 
> ==============================
> 
>>> Fix:
> NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see
> Timeline below), so no fix is available.
> Do not expose any of these devices to the Internet or any networks with
> unstrusted hosts.
> 
> Timeline:
> 28.02.2016: Disclosure to CERT/CC.
> 27.04.2016: Requested status update from CERT - they did not receive any
> response from vendors.
> 06.06.2016: Requested status update from CERT - still no response from
> vendors.
>             Contacted Nuuo and NETGEAR directly. NETGEAR responded with
> their "Responsible Disclosure Guidelines", to which I did not agree and
> requested them to contact CERT if they want to know the details about
> the vulnerabilities found. No response from Nuuo.
> 13.06.2016: CERT sent an update saying that NETGEAR has received the
> details of the vulnerabilities, and they are attempting to contact Nuuo
> via alternative channels.
> 07.07.2016: CERT sent an update saying that they have not received any
> follow up from both Nuuo and NETGEAR, and that they are getting ready
> for disclosure.
> 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that
> disclosure is imminent if CERT doesn't receive a response or status
> update. No response received.
> 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that
> disclosure is imminent if CERT doesn't receive a response or status
> update. No response received.
> 04.08.2016: Coordinated disclosure with CERT.
> 
> 
>>> References:
> [1] https://www.kb.cert.org/vuls/id/856152
> 
> 
> ================
> Agile Information Security Limited
> http://www.agileinfosec.co.uk/
>>> Enabling secure digital business >>

Forgot to mention - these are actually "0 days" since the vendors didn't
bother to respond or issue fixes - see timeline above.

Regards,
Pedro