lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 2 Oct 2017 18:14:47 +0300
From: John Torakis <johntorakis@...sus-labs.com>
To: oss-security@...ts.openwall.com
Cc: fulldisclosure@...lists.org, bugtraq@...urityfocus.com
Subject: [FD] CVE-2017-9807: e2openplugin-OpenWebif: Remote code execution
 through HTTP GET parameter manipulation

Hello all,

e2openplugin-OpenWebif is an open source web interface plugin for IP TVs
and media centers. It is found in several IP TV software images and
hardware products including the commercial Dreambox devices.


A remote code injection vulnerability was found in the "key" HTTP GET
parameter of the "/api/saveconfig" API call.

Further analysis of the vulnerability can be found here:
https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/

The vulnerability allows remote code execution on hosts running the
aforementioned plugin. Some devices affected also run the plugin under
root privileges (e.g: Dreambox DM800 HD se), allowing for complete
remote takeover of the host.

This defect has been patched by the vendor with the git commit:
09a050c8f04afd3bb4a14af98994be255aae10d9
(https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/commit/09a050c8f04afd3bb4a14af98994be255aae10d9).

Administrators of affected devices are strongly advised to update their
running instance of e2openplugin-OpenWebif to the latest version of the
code. An official release containing the fix has not been released yet.


References:
https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9807
https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/

Disclosure Timeline:
Vendor Contact: June 21st, 2017
CVE assignment: June 22nd, 2017
Vendor Patch: September 15th, 2017
Public Advisory: October 2nd, 2017


Regards,
--
John Torakis

Security Researcher
CENSUS S.A.


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists