full-disclosure - [FD] [CVE-2018-16225] QBee MultiSensor Camera LAN Traffic Vulnerability

Open Source and information security mailing list archives

Message-ID: <EF319F59-3193-4472-BAB0-2BA7A26866F9@unil.ch>
Date: Sun, 16 Sep 2018 21:26:29 +0000
From: Francesco Servida <francesco.servida@...l.ch>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] [CVE-2018-16225] QBee MultiSensor Camera LAN Traffic
	Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.

[VulnerabilityType Other]
 Auth bypass using cookie

[Vendor of Product]
 QBee, Vestiacom, Swisscom

[Affected Product Code Base]
 QBee MultiSensor Camera <= 4.16.4
 QBee Cam (Android) <= 1.0.5 (Fixed version number not yet available)
 QBee Cam (iOS) < 1.5.2
 Swisscom Home App (Android) < 10.7.2
 Swisscom Home App (iOS) < 10.9.0

[Affected Component]
 Network Traffic

[Attack Type]
 Remote

[Impact Denial of Service]
 true

[Impact Information Disclosure]
 true

[Attack Vectors]
 Reuse of intercepted cookies to authorize requests to camera and disable it

[Has vendor confirmed or acknowledged the vulnerability?]
 true

[Discoverer]
 Francesco Servida (University of Lausanne)

[Reference]
 https://francescoservida.ch/
 https://blog.francescoservida.ch/2018/09/16/cve-2018-16225-public-disclosure-qbee-camera-vulnerability
 https://unil.ch/esc/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE1d1OaNNWm59k5XpArHdrFWRKXbEFAlueyQcACgkQrHdrFWRK
XbHlXA/+MwKRO1X7s85ViBEo0gaMNI2GIxioAwi7Hoqkn+jEEefBAkGLFy02F+MS
6i8f1C+AU88BJroihmuBhFklg6/d5qilQrym40MN2/qmr8g2ba7mayZxzRoa4jOn
JAggmnLbv0ODV0aIJpWWWDOgLNyZgn2ZfBt7glnSifJ4TTNJUN0xNGUcsYCAfbjo
zDjJknPFimxaM0ECJpNWMTMH2z8FJD8Cfb6uQjC9ZR6yy3Gd/xyyesyjcIf7L/56
bkVQUmzI3xLKIAISQ2WbqaMLemds69rWV3ePwrdyziUbkxflW0pKK9ObzcpoFkRD
fOZvqPgvkbBpFyE2xbImqqHtgwYiI27oXPJyc183mrR3XTbfFfOuXwDJSrNYPTyp
ZQwWyFAr25VqJriq4mfvr643U2ejexblwTi5Rnekf0spF2sFkjZGk1HLu095Yzx3
wThFmj8U8U/MyiUdRC8eW6Q/G0xw4lhqtQA8lxo5k7AOF9AkVImtYqk506Lx1JU8
LbJqy/3EoJleva5BWdBgTjH99zmbOHuvyGZRR8oNKDTBEUY3X2RnVeA3QUrhkEl5
Dgn1mJ/2Ztwyun6X3VcFoRQTAaHqfBb17EYzlE+92cU6SYxaFALO7PUBN/UUDIks
Gd6uuT5pJB2P/RrPEqAp2vjqgwNXQuarp44oPXAsriWRwEzeUbg=
=pHaV
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives