SEC Consult Vulnerability Lab Security Advisory < 20160602-0 >
=======================================================================
title: Multiple critical vulnerabilities
product: Ubee EVW3226 Advanced wireless voice gateway
vulnerable version: Firmware EVW3226_1.0.20
fixed version: -
CVE number: -
impact: critical
homepage: http://www.ubeeinteractive.com
found: 2016-01-09
by: Manuel Hofer (Office Vienna)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Bangkok - Berlin - Linz - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Ubee Interactive is on a mission. A mission that began with the development
of our industry-defining line of DOCSIS cable modems. And one that continues
with a drive toward becoming the leading business-to-business provider of
broadband connectivity products and solutions worldwide. Our current product
portfolio includes data, voice, video, mobility and portable devices."

Source: http://www.ubeeinteractive.com/products/cable/evw3226


Business recommendation:
------------------------
Network security should not depend on the security of independent devices, such
as cable modems. An attacker with root access to such a device can enable
attacks on connected networks, such as administrative networks managed by the
ISP or other cable modem users.

Vulnerabilities described in this security advisory might be exploited in
combination with other vulnerabilities not associated with this product (XSS in
web forums accessing the modem, malvertising, etc.).

It is highly recommended by SEC Consult not to use this device until a
thorough security review has been performed by security professionals and all
identified issues have been resolved.

It is assumed that further critical vulnerabilities exist within the firmware
of this device.


Vulnerability overview/description:
-----------------------------------
1) Missing authentication for configuration download
The admin interface does not explicitly require any authentication prior to
downloading a previously requested configuration backup file.

2) Plaintext storage of administrative password
The password for the user "admin" is stored in clear text. An attacker with
access to the configuration file or the device itself, can easily obtain this
password. By exploiting issue 1) the clear text admin password can be retrieved.

3) "Encrypted" configuration backup not actually encrypted
A certain built in cgi action asks the user to provide a password in
order to "encrypt your configuration's backup". A quick analysis of this
function has shown that the configuration backup does not actually get encrypted,
and only a file "pass.txt" is appended to the archive containing the password
provided by the user, in cleartext. Additionally, this promotes a false sense of
security as in this case, an attacker with access to the configuration file can
easily obtain the clear text password for the admin interface.

4) Authenticated arbitrary file upload leading to arbitrary command execution
By analyzing the configuration file format and further exploiting a known
vulnerability inside the busybox tar implementation it is possible to upload
arbitrary files to the device. This enables an attacker to execute arbitrary
system commands and gain full root access on the device.

5) Heap-based buffer overflow vulnerability in URL decoding
The function responsible for URL decoding allocates the buffer for the decoded
string based on the number of '%' characters in the request string. This leads
to a heap based buffer overflow.


Proof of concept:
-----------------
Since no public fix is available for any of the described vulnerabilities yet,
the proof of concept will not be published.


Vulnerable / tested versions:
-----------------------------
The following firmware has been tested which was the most recent version
at the time of discovery:
EVW3226_1.0.20


Vendor contact timeline:
------------------------
2016-01-13: Contacting CERT.at for security contact of
UPC Austria (Liberty Global)
2016-01-17: Contacting vendor Ubee Interactive through
'eusupport@ubeeinteractive.com' and 'eusales@ubeeinteractive.com'
requesting security contact.
2016-01-17: Disclosure of identified vulnerabilities to UPC Austria in advance.
2016-01-20: No reply from Ubee Interactive. Requesting direct contact through
UPC Austria.
2016-01-22: Received contact at Ubee Interactive. Establishing contact with
<Michael.Mao@ubeeinteractive.com> again asking for public key to
send encrypted advisory.
2016-01-23: Sending unencrypted advisory to Michael Mao and Kyle Li at Ubee.
2016-02-29: Asking Ubee for status update.
2016-02-29: Ubee states vulnerabilities 1-4 are fixed. still working on 5.
Rollout to UPC customers will need more time.
2016-02-29: SEC Consult postpones release to 2016-04-04, after discussing the
issues with UPC Austria.
2016-04-04: Asking again for status of patch deployment. No answer, rescheduling.
2016-05-13: Announcing advisory release for 2016-06-02 to UPC and asking for
status of patch deployment again.
2016-05-13: UPC Austria replies. No details, status will be provided later.
2016-05-26: Asking again for status of patch deployment, reminding about release
date.
2016-05-27: UPC Austria replies. Details on status will be provided next week.
2016-05-31: Advisory coordination with UPC.
2016-06-01: Receiving statement of UPC regarding patch status
2016-06-02: Public release of security advisory without detailed PoC as there
is no patch available.


Solution:
---------
There is no public patch available yet, it is currently in testing phase.

Here is a statement from UPC Austria concerning this issue:

"We are in close contact with the manufacturer and are working together on a
solution to the problems caused by the factory. The update will be implemented
some time in June following successful testing. In addition, UPC is continuing
with the modem swap project. Over the past 2 years, we have already provided more
than 200,000 customers in Austria and Switzerland with a new-generation modem
free of charge." (Source: UPC from 2016-06-01)


Workaround:
-----------
No workaround available.


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Manuel Hofer / 2016