CVE-2017-8227

{"id": "CVE-2017-8227", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-07-03T20:15:10.510", "references": [{"url": "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}], "descriptions": [{"lang": "en", "value": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification (which is supported by the same binary) then there is no account lockout or timeout executed. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that performs the credential check in the binary for the ONVIF specification. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 00671618 in IDA pro is parses the WSSE security token header. The sub_ 603D8 then performs the authentication check and if it is incorrect passes to the function sub_59F4C which prints the value \"Sender not authorized.\""}, {"lang": "es", "value": "Los dispositivos Amcrest IPM-721S V2.420.AC00.16.R.20160909 tienen una pol\u00edtica de tiempo de espera para esperar 5 minutos en caso de que se detecten 30 intentos de contrase\u00f1a incorrectos mediante la interfaz web y API de HTTP proporcionada por el dispositivo. Sin embargo, si se realiza el mismo intento de fuerza bruta utilizando la especificaci\u00f3n ONVIF (que es compatible con el mismo binario), entonces no se ejecuta el bloqueo de la cuenta o el tiempo de espera. Esto puede permitir a un atacante eludir el mecanismo de protecci\u00f3n de la cuenta y forzar las credenciales. Si la versi\u00f3n del firmware V2.420.AC00.16.R 9/9/2016 se diseca con la herramienta binwalk, se obtiene un archivo _user-x.squashfs.img.extracted que contiene el sistema de archivos configurado en el dispositivo que muchos de los binarios en la carpeta / usr. El \"sonia\" binario es el que tiene la funci\u00f3n vulnerable que realiza la verificaci\u00f3n de credenciales en el binario para la especificaci\u00f3n ONVIF. Si uno abre este binario en IDA-pro, notar\u00e1 que sigue un formato ARM little endian. La funci\u00f3n en la direcci\u00f3n 00671618 en IDA pro es analizar el encabezado del token de seguridad WSSE. El sub_ 603D8 luego realiza la verificaci\u00f3n de autorizaci\u00f3n y si es incorrecto pasa a la funci\u00f3n sub_59F4C que imprime el valor \"Remitente no autorizado\"."}], "lastModified": "2024-11-21T03:33:34.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EC72AB3-67BC-4187-8918-8030B045F383", "versionEndIncluding": "2.420.ac00.16.r.20160909"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A8A354BD-B8FC-45D1-B8B2-5A44334CF2F8"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}